Web applications, especially amateurish ones, are insecure. I'm sure there are bigger sploits in FB itself.