The 'ibillpm.pl' CGI is installed. Some versions of this CGI use a weak password management system that can be brute-forced. ** No flaw was tested. Your script might be a safe version. Solutions : upgrade the script if possible. If not: 1) Move the script elsewhere (security through obscurity) 2) Request that iBill fix it. 3) Configure your web server so that only addreses from ibill.com may access it.