You've got a pretty big security hole here.

You aren't doing any sanity checking on the city/state input -- and Geo::WeatherNOAA isn't doing it for you. Given a bogus city/state combo, make_noaa_table is perfectly happy to output a large chunk of HTML which indicates that there was a Network problem retrieving a URL constructed using the users bogus state/city.

If a malicious user hit this CGI repeatedly using giberish as the city/state, they could easily fill up your disk in no time.

PS: even if you aren't worried about that, you should be scrubbing your input at least a little to make sure i don't enter something like "../../../../../../../../../" as my city..