Shell injection
When unsanitised input is executed as a shell command — attackers can run arbitrary commands on the server.
Classic: system("ping " + user_input). The user types 1.1.1.1; rm -rf /. Defence: never build shell strings from input. Use the language's array-form APIs (Python's subprocess.run([])) that don't interpret shell metacharacters.