One bug or multiple bugs ???

Hello Chris, you already know what i am going through at this point. So my ongoing problem is trying to focus on a particular kind of bug. For me, XSS originally caught my interest, but then you showed me SQL i and OS Command Injection. Those two seemed to be prime targets that only require what is happening on the server itself. Of course i don't expect this to be easy, but in my case a little leniency would help. So long story people out there tell me focus on all vulnerabilities while others say one or two at most. I know you told me not to listen and i don't, but it still goes through my head each day.

- So in your professional opinion which would be less competitive and more rewarding if found and proven ???

Cross-Site Scripting ?
SQL Injection ?
Command Injection ?

<div>

I may sound like a broken record Chris but i need your input.

</div>