Which of the following web vulnerabilities would an attacker be attempting to exploit if they delivered the following input? <!DOCTYPE blah [ < IENTITY trustme SYSTEM "file:///etc/passwd" > ] >

XXE injection exploits XML parsers that resolve external entity references without restriction. The payload <!DOCTYPE blah [<!ENTITY trustme SYSTEM 'file:///etc/passwd'>]> defines an entity that maps to the server's /etc/passwd file; when the entity is referenced in the document body the parser reads and returns the file contents, enabling sensitive data disclosure or server-side request forgery.

SQL injection inserts malicious SQL syntax into database query strings; the payload shown uses XML DOCTYPE and ENTITY declarations which are completely outside the SQL grammar.

IDOR exploits broken access controls by manipulating identifiers such as user IDs in HTTP requests to access unauthorized objects, with no involvement of XML parsing or entity resolution.

XSS injects client-side script into pages rendered by other users' browsers; it requires HTML or JavaScript payloads, not XML DOCTYPE declarations with SYSTEM entity references.