A victim visits a website that allows authenticated users to upload articles for other users to read. The victim logs in and clicks a link on the website's home page for a newly posted article. When…

SQL injection manipulates database queries through unsanitized input; it does not cause script execution in a victim's browser.

In a stored XSS attack, the attacker uploads malicious JavaScript as part of content (here, an article) that the application saves to the database. When any authenticated user later loads that page, the server delivers the malicious script as part of the page, the browser treats it as legitimate, and the script executes with access to the victim's session cookies and DOM - allowing exfiltration of sensitive data to the attacker.

Cross-Site Request Forgery tricks a victim's browser into making authenticated requests to a site, but does not involve injecting and executing malicious code within the site itself.

Session hijacking involves stealing an existing session token after it is obtained by other means; it is not a vulnerability that causes malicious code to run in the victim's browser.