Sometimes web servers are configured allowing a wide range of HTTP verbs an attacker can use to upload arbitrary content defacing the site.