Which OWASP threat occurs when untrusted data is supplied as input to an interpreter as part of a command or query?

Broken authentication refers to weaknesses in session management, credential handling, or login mechanisms - not the act of supplying untrusted data to an interpreter.

Sensitive data exposure refers to inadequate protection of data at rest or in transit, not to manipulation of an interpreter via malicious input.

Injection is the OWASP category covering flaws where hostile data is sent to an interpreter - such as a database, OS shell, or LDAP server - as part of a command or query, enabling attackers to alter execution logic; common examples include SQL injection and OS command injection.

Cross-site scripting injects client-side scripts into web browsers and is a narrower, browser-targeted attack - the broader OWASP category for interpreter manipulation via untrusted input is Injection.