As was said, it was tried and was unsuccessful with the exception of an image just like you all do, upload images to the site, however they were able to upload it to a different directory and with a specific file name but again you are allowed to upload images to the site but also image files are screened for any embedded code as well. Logs show that it was blocked from doing anything else.
The site also uses 1 way encryption of passwords. In other words when you put your password in it gets stored as gobblegook characters that mean nothing. When you login again it checks that your password goes through a conversion process and matched the gobblegook. BUT, there is no way the gobleggook can go the other way into an actual password that can be read...for example the process may go through a loop x number of times dropping off the last y characters each time that is what is meant as 1 way as you can't get the characters that are dropped off back again if you try to go from goblegook back to your password...ask a coder what 1 way password encryption means and they may be able to explain it easier for you to understand FlyBoy1960