1. A system, comprising: a physical processor; and a non-transitory storage medium storing machine readable instructions executable on the physical processor to: determine whether a set of instructions executed by an application under testing includes a set of database instructions; responsive to determining that the set of instructions includes the set of database instructions: determine whether a first database instruction of the set of database instructions causes information to be entered into a database; determine whether a second database instruction of the set of database instructions causes the information to be obtained from the database; responsive to determining that the first database instruction causes the information to be entered in the database and the second database instruction causes the information from the database to be obtained from the database, target, by a scanner, the first and second database instructions of the application in a simulated attack using simulated malicious code, and determine, based on the simulated attack, vulnerable computer code in the application that causes entry of malicious code into the database via execution of the first database instruction and executes the malicious code via execution of the second database instruction; and filter out other instructions of the application from vulnerability detection by the scanner, by declining to perform a simulated attack using simulated malicious code on the other instructions of the application, in response to determining that the other instructions do not enter information into and obtain information from the database.