A victim browses to a news aggregator website through a link sent to them by an attacker. The attacker then alters the page delivered to the victim's browser and includes malicious links. What flaw on

SQL Injection targets backend database queries to manipulate or exfiltrate stored data; it does not alter the HTML or JavaScript content delivered to a victim's browser.

Reflected XSS occurs when an attacker embeds a malicious script payload within a URL and sends it to a victim - when the victim clicks the link, the vulnerable server reflects the unsanitized input back in the HTTP response, causing the script to execute in the victim's browser. The scenario matches exactly: the attacker sent the link, the victim browsed to it, and the page content was altered with malicious inclusions before being rendered.

Cross-Site Request Forgery tricks an already-authenticated user into submitting unauthorized requests to a site, but it does not modify or inject content into pages delivered to the victim's browser.

Buffer Overflow exploits memory mismanagement in software to overwrite adjacent memory regions and is a host-level vulnerability, not a web content injection technique.