bmossavari is right: no coppermine version ever contained files named misc.php nor forum.php. As your links point to your local machine, we can't examine any further. Anyway: if your machine can only be accessed locally, why do you worry abot XSS?
If you think you actually found a vulnerability and not some bogus stuff detected by a questionable app that
claims to be able to detect XSS vulnerabilities, please post actual details, i.e. vulnerable code snippets that come from coppermine.
As suggested: the "tool"
JAAScoisAWIen is very questionable, as google only contains hits for the website of the company that created the tool. How could an executable that only runs under Windows be a reliable webserver security tool? Looks like a trojan to me.
No offense though, thanks for the report.