Forget SSL injection and cross-site scripting, there's a new website vulnerability in town -- and you can't scan for it.