Custom applications are subject to the same vulnerabilities as any other application, and securing these vulnerabilities can often be more problematic than securing more common applications.
An in-house application is unlikely to have a patching system in place.