You know what ain't vulnerable? A text file saved as html with some css.