1) Input passed to the "lang" parameter in portal/scr_changelang.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources via directory traversal attacks and URL-encoded NULL bytes. 2) Input passed to the "message" parameter in portal/login.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
Michael, before opening you should do a bit search, this xss is reported in a web-app application[1]. app-shell/posh is a different application. [1]: http://sourceforge.net/projects/posh/
