Design/Logic Flaw

Twonky Server before 8.5.1 has XSS via a modified "language" parameter in the Language section...