Probably just semantics. But I consider it an exploit if you are knowingly doing something that should not be possible. Like changing a url from"?4" to "=4" causing an immediate free skill gain. That's an exploit. Loopholes are generally design oversights. Behaviors that were not anticipated. Like clicking links in the order ACB instead of ABC. This could just be my personal distinction, though.
