Some NoSQL databases work using application codes for their queries. Attackers can perform unwanted actions like  running malicious code and unvalidated data on a NoSQL database through those application codes.