A penetration tester is performing a code review against a web application Given the following URL and source code: Which of the following vulnerabilities is present in the code above?

SQL injection targets database query interpreters using SQL metacharacters; the URL and code pattern described invoke OS-level execution, not a database layer.

Cross-site scripting involves injecting malicious scripts into output rendered by a browser; the vulnerability here affects server-side command execution, not client-side rendering.

Command injection occurs when user-controlled input is concatenated into an OS-level command call (e.g., via exec(), system(), or shell_exec()) without proper escaping or allowlisting. An attacker can append shell metacharacters such as semicolons, pipes, or backticks to break out of the intended command and execute arbitrary operating system commands. This is distinct from SQL or LDAP injection because the target interpreter is the OS shell, not a query language.

LDAP injection manipulates LDAP directory queries; nothing in the described pattern interacts with an LDAP service or query syntax.