what does this allow ?

[Vince Hoffman <Vince.Hoffman () uk circle com>]

Hi all,
        I was running a routine nessus scan on some servers i administrate
and one of them gave me a warning of

The following requests seem to allow the reading of
sensitive files or XSS. You should manually try them to see if anything bad
happens : 
/default.asp?gateway=<script>alert('foo')</script>

I tried that and it worked, I forwarded it to a developer for that machine
and he didnt seem worried by it. Should he be ?
A bit vague i know but webapps arent realy my forte.

Thanks,
Vince