[remram]

Yes for sure. An RCE in the first is sufficient, or an auth bypass in the first and some other vulnerability in the second.