Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function printCard() {
    getData()
    let html = ""
    for (let i = 0; i < entries.length; i++) {
        let entry = entries[i]
        entry.residency = entry.zip + " " + entry.residency
        if (!entry.sex) entry.sex = "uk"
        html += `<div>
            <p class="name">${entry.name}</p>
            <p class="birthdate">${dateToStandard(entry.birthdate)}</p>
            <p class="residency">${entry.residency}</p>
            <p class="street">${entry.street}</p>
            <p class="district">${entry.district}</p>
            <p class="place">${entry.place}</p>
            <p class="start">${dateToStandard(entry.start, true)}</p>
            <p class="first-name">${entry.firstName}</p>
            <p class="${entry.sex}">&times;</p>
            <p class="nationality">${entry.nationality}</p>
            <p class="identity-disk">${entry.identityDisk}</p>
            <p class="rc-unit">${entry.rcUnit}</p>
            <p class="unit">${entry.unit}</p>
        </div>`
    }
    document.getElementById("print-area").innerHTML = html
    print()
}