Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
null!=b.currentPage&&null!=b.pages&&(L=mxUtils.indexOf(b.pages,b.currentPage));for(J=f.length-1;0<=J;J--){var T=function(W){var X=new Date(W.modifiedDate),Y=null;if(0<=X.getTime()){var Z=function(ha){c.stop();E.innerText="";var na=mxUtils.parseXml(ha),ea=b.editor.extractGraphModel(na.documentElement,!0);if(null!=ea){var za=function(Ba){null!=Ba&&(Ba=Ca(Editor.parseDiagramNode(Ba)));return Ba},Ca=function(Ba){var ba=Ba.getAttribute("background");if(null==ba||""==ba||ba==mxConstants.NONE)ba=F.defaultPageBackgroundColor;