Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
null!=aa&&0<aa.length){var Sa=function(Oa){T.setAttribute("disabled","disabled");ra.style.backgroundColor="transparent";ra.style.border="1px solid transparent";N.spin(fa);Ja(aa,function(Ya,Wa){N.stop();null!=Ya&&(F(ra,Ya,la,null,null,Aa,Wa),Oa&&L())})};ha=Ma||TEMPLATE_PATH+"/"+aa.substring(0,aa.length-4)+".png";ra.style.backgroundImage="url("+ha+")";ra.style.backgroundPosition="center center";ra.style.backgroundRepeat="no-repeat";if(null!=na){ka=document.createElement("table");ka.setAttribute("width",