The app server admin console is automatically installed and not removed. Default accounts aren’t changed. Attacker derives the standard admin pages are on your server, logs in with default passwords, and start playing with the website. This is the kind of Web security risk :