Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
H.pageFormat.width*oa;K.pageHeight=H.pageFormat.height*ca;K.backgroundClr=H.background;K.mathEnabled=H.mathEnabled;K.shadowVisible=H.shadowVisible}catch(qa){}return K}function g(H,K,P,Q){return b(H,K/J.CONVERSION_FACTOR,P,Q)}function b(H,K,P,Q){P=A(P,J.XMLNS,"Cell");P.setAttribute("N",H);P.setAttribute("V",K);Q&&P.setAttribute("F",Q);return P}function a(H,K,P,Q,R){var ha=A(R,J.XMLNS,"Row");ha.setAttribute("T",H);ha.setAttribute("IX",K);ha.appendChild(g("X",P,R));ha.appendChild(g("Y",Q,R));return ha}