This guy on Reddit also noticed a security issue years ago...

http://www.reddit.com/r/netsec/comments/3qqo79/000webhost_da...