What is the difference between a vulnerability and an attack surface?

A vulnerability is the risk of exploiting a weakness in the application, and the target application itself is the attack surface

The attack surface is the SQL injection targeted on the database, and the database is the vulnerability that might be exploited.

The attack surface is a sum of measured risks for a particular asset, and the vulnerability is an unmeasured exploitable risk

A vulnerability is unsanitized user input sent to exploit a web application and the browser is the attack surface for the web application