The most vulnerable environments for code injection are SQL, LDAP, XPath, and NoSQL. But code injection attacks are also possible in operating system scripts, SMTP headers, program arguments, XML parsers, etc. In addition, code injection can also target applications written in Python, HTML injection, PHP, and JavaScript.