Canon Oce Print Exec Workgroup 1.3.2 allows XSS via the lang parameter.
canon oce print exec workgroup 1.3.2