Years ago I had /var/www/lights_on.sh that turned lights on in my room. Only hardened against RCE by Wi-Fi password, but was possible. It broke later. The real problem was that browsers sometimes prefetched it.