Without validating user input, an application becomes vulnerable to all of the following EXCEPT:

Buffer overflow attacks occur when unsanitized input exceeds the memory buffer allocated by the application, making input validation a direct mitigation.

Command injection attacks insert OS commands through unsanitized input fields that are passed to a shell, and proper input validation would prevent this.

Spear phishing exploits human trust through crafted emails or messages rather than application input fields; it is a social engineering vector that occurs entirely outside the application's input-handling code, making it the one attack that input validation cannot prevent.

SQL injection attacks occur when user-supplied input is embedded directly into database queries without sanitization, making it a classic input validation failure.