Occurs when an attacker can send untrusted input into a web application, tricking it into executing unintended commands or accessing data without proper authorization. Common types include SQL, NoSQL, and OS command injections.