Reminds me of a Wordpress site that ended up having a bunch of files uploaded to the uploads directory with the extension .php -- and the webserver allowed them to be executed. Unfortunately things like this are often overlooked!