Data execution prevention is a feature in most operating systems intended to protect against which type of attack?

Cross-site scripting is a web application vulnerability involving injected client-side scripts in a browser context and is mitigated by output encoding and Content Security Policy, not memory execution controls.

Buffer overflow attacks work by overwriting executable memory regions with malicious shellcode, then redirecting program execution to that code. DEP enforces a hardware or software policy that marks stack and heap regions as non-executable (NX/XD bit), so even if an attacker successfully overflows a buffer and injects code, the CPU will raise an exception rather than executing it.

Header manipulation involves altering HTTP request or response headers to exploit web application logic and is addressed by input validation and server-side controls, not DEP.

SQL injection targets back-end database queries through unsanitized input and is prevented by parameterized queries and input validation, not memory execution protection.