Developers need to be aware of a common application programming interface (API) threat that occurs when attackers send malicious code through a form input to a web application so that it may then be executed. Which type of attack represents this API threat?

Credential attacks involve attempts by attackers to gain unauthorized access by stealing or guessing user credentials, such as usernames and passwords. While important, this type of threat does not involve sending malicious code through form inputs for execution, making it distinct from injection attacks.

Denial-of-service (DoS) attacks aim to make a service unavailable by overwhelming it with traffic or exploiting vulnerabilities. This type of attack does not involve injecting malicious code into an application but rather focuses on disrupting services, which is fundamentally different from the nature of an injection attack.

On-path attacks (formerly known as man-in-the-middle attacks) involve intercepting communications between two parties to eavesdrop or alter messages. This threat does not pertain to executing malicious code via form input, thus it does not fit the context of the question.