There's always cgi vulnerabilities. He's probably a script kiddie though.