Web Vulnerabilities
Untrusted Input
Also: user input, attacker-controlled data
Any data your program did not create itself: form fields, URLs, file names, uploads, API replies, and text an AI agent reads.
In more detail
If a value could have been chosen or altered by someone other than the developer, it is untrusted until the program has checked it. That includes the obvious (a search box) and the easy to forget (a file name inside an upload, an HTTP header, a web page an agent fetches). Most web vulnerabilities are untrusted input reaching something powerful without a check.