SQL injection
When an attacker sneaks SQL code into a form and gets the database to execute it.
Classic: a login form that builds the query SELECT * FROM users WHERE name = '$name'. If the attacker types ' OR 1=1 -- as the name, the query becomes SELECT * FROM users WHERE name = '' OR 1=1 --' and returns all users.
The fix is always the same: prepared statements / parameterised queries. User input is data, not code. Practically every modern language has built-in support.