@SteffenUllrich yes there might be other methods like you described but there are other people to handle that, i just want to get knowledge about the ways an attacker can get access to the system through the site directly. That way i can get an idea to fix those loopholes.

@schroeder yes there are many ways a site could be hacked, but i was only referring to certain methods that i further edited. Don't know why you have to close the question, but anyways i do get some valuable insight from these people to go in the right direction and harden security of the site.

@forest i dont have knowledge about this, if someone is able to upload a polyglot file, How they can able to run it?

@ConorMancone I am just a part of the team but i am concerned and like to know if the attacker was able to enter via the site or some other way. If they got through the site then i want to learn all the ways to fix before this happen again. I've edited the question with what i've researched so far, would you like to help.