This isn’t the trifecta.

It’s:

* Untrusted input

* Privileged access

* Exfiltration vector