Found a vulnerability it oldcp_api, it's not a serious one. But still Damen you should patch it.

http://blizzard.api.play.oldcp.biz/oldcp_api/login.php?Username=<script>alert("Got to love XSS")</script><h1>TimeLock rocks</h1>

Client's browsers don't run javascript or parse html from that resource when logging in via oldcp, it is no threat.