The security defects could be exploited for remote code execution, OS command injection, and WAF detection bypass.
One week, two tools, a lot of opinions.