Class.forName loading a class from a variable enables attacker-controlled class loading.
Restrict loadable classes to an allowlist rather than instantiating from raw input.