Comment by elwell

Which points out that the context has to considered as well. E.g., if it's a personal intranet or password protected page, this may not be vulnerability.