Which of the following is an example of IP spoofing?

SQL injection is a code injection technique that manipulates unsanitized database queries through application input fields, with no involvement of IP address forgery.

In a man-in-the-middle attack, the attacker forges the source IP address to impersonate a legitimate host, which is the defining characteristic of IP spoofing. By presenting a falsified IP identity, the attacker can intercept, read, and potentially alter traffic flowing between two victims who believe they are communicating directly with each other.

Cross-site scripting injects malicious client-side scripts into web pages to execute in victims' browsers, which is a web application attack unrelated to IP address manipulation.

ARP poisoning forges MAC address-to-IP mappings at Layer 2 of the OSI model, not source IP addresses at Layer 3, so it is address spoofing but not IP spoofing specifically.