I'm never ceased to be amazed at "holes" in software that's been around for ages -- that is, simple bugs that have had plenty of time to be detected and quashed but somehow aren't. This week I ran into an oversight in the venerable DotNetNuke (aka "DNN") web platform which is a nicely-featured framework for quickly building .NET-based websites.
DNN has been around for over a decade yet the bug that tried to bite me is a simple oversight in how account usernames are handled...