Remote users can submit search queries, and view queries and personal links left by other users.
It's possible to access the configuration interface, which can reveal the e-mail address of the user who registered it. Configuration settings can be changed remotely to, for instance, add, remove or alter personal links. If your web server records the http Referer header field. By automating this process, you can get the email addresses of users who find your page through Express Search. Express Search users can also be discovered by scanning entire netblocks for TCP port 1234 with a utility such as nmap.