Oh there are more, lots more. For instance if you just do:

  open (FILE, $file) or die "Cannot read $file: $!";
[download]

someone can pass a string that turns into a system command. You won't ever catch all of the possible nasties (fun stuff can be done with \0 for instance) which is why you need to make a list of what you explicitly permit and only pass that, rather than plugging the holes individually as you learn them.