Which of the statements below are valid

CSRF attacks cannot result in unauthorized actions being performed on behalf of the user, such as unauthorized purchases or account changes.

Code injection attacks can lead to disruption of the normal functioning of a web application but not to unauthorized access to sensitive information.

Cross$-$Site Scripting $($XSS$)$ is listed among the OWASP Top $10$ security risks.

CSRF attacks are often executed by tricking the victim into clicking a malicious link or submitting a form.