Security Headers

I have no idea what I am doing, but I am trying to learn. I have read that when a site doesn't use X-Content and CSP it once was possible to inject or reflect new pages into the site and I am wondering if this is still possible and how to do it. Among many other things lol.