> Log4j is a guaranteed remote-execution exploit just by filling in a user facing form with the correct URL This is only true of systems that were using very o

> Log4j is a guaranteed remote-execution exploit just by filling in a user facing form with the correct URL This is only true of systems that were using very outdated JVM versions... on the newer ones (we're talking 2016 or newer JDK releases, not like last month), you would need to pull off a serialization exploit to indirectly get RCE, which is quite a bit harder than sending a HTTP request.