4 allows remote attackers to inject arbitrary web script or HTML via search terms that are not properly filtered before display in a custom results page. Net which utilizes powershell.