Three very common webserver attacks would be Cross-Site Scripting attacks, and SQL Injection attacks, and Directory Traversal Attacks (maybe the most common).
All of these are very similar, and if successful are the result of poor input validation.
While these may not actually put the physical server itself at risk, there are more painful things than losing a server. Like losing a database full of financial processing information, or PII.
Input validation is probably the single most important thing for web application developers to understand.
Even a very simple app, like a script that makes files available for viewing or download can put you at risk if you're passing files with a path to a script to cause the file to be downloaded or viewable, and you don't do any sanitizing on the paths to ensure, for example, that they are relative, and within the DOCUMENT_ROOT, then you could end up with a webserver that would be quite happy to display your /etc/shadow file, or your iptables configuration, or anything else that lives in a file on your server.