Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
null!=aa&&0<aa.length){var Pa=function(Na){V.setAttribute("disabled","disabled");ra.style.backgroundColor="transparent";ra.style.border="1px solid transparent";O.spin(da);Ja(aa,function(Ya,Wa){O.stop();null!=Ya&&(A(ra,Ya,la,null,null,ya,Wa),Na&&I())})};fa=La||TEMPLATE_PATH+"/"+aa.substring(0,aa.length-4)+".png";ra.style.backgroundImage="url("+fa+")";ra.style.backgroundPosition="center center";ra.style.backgroundRepeat="no-repeat";if(null!=ma){ja=document.createElement("table");ja.setAttribute("width",