Comment by layer8

Unvalidated input can always be an exploit vector.