It's not surprising. A hack is still a hack, even you apply industry best practices in testing. There are two major security entry points, and none of them were closed since.

This is the paper describing both. https://research.checkpoint.com/2019/select-code_execution-f...