Cross site scripting

Maccms 8.0 allows XSS via the inc/config/cache.php tkey parameter because template/paody/html/vodtype.html mishandles the keywords parameter, and a/tpl/module/db.php only filters the tname parameter not tkey...