What are two examples of code injection vulnerabilities? (Choose two.)

XML external entity (XXE) injection exploits XML parsers to process external entity references, which is a specific type of vulnerability related to XML processing, distinct from general code injection like XSS or SQLi.

Cross-site scripting (XSS) is a type of code injection vulnerability where malicious client-side scripts are injected into web pages viewed by other users.

Session hijacking is an attack where an attacker gains control of a user's session, but it is achieved by stealing or manipulating session tokens, not by injecting malicious code.

SQL injection is a code injection technique used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g., to dump database contents to the attacker).

Arbitrary command injection is indeed a form of code injection, specifically targeting the execution of operating system commands, but the question asks for two examples, and B and D are identified as the correct answers for this question.