Code injection is a form of attack in which a malicious user:

Code injection occurs when a malicious user inputs data into an application, and that data is processed and executed by the application as code, rather than being treated merely as data.

Getting a server to execute arbitrary code using a buffer overflow is a specific exploitation technique, not the broad definition of code injection which focuses on input interpretation.

Inserting code into the JavaScript running in the browser is a specific type of client-side script injection (XSS), which is a subset of code injection, but not its overarching definition.

Gaining access to the codebase on the server and inserting new code describes backdooring or unauthorized code modification, which requires prior access and is distinct from exploiting input fields for injection.