Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function q(G){null!=G&&(G=p(Editor.parseDiagramNode(G)));return G}mxEvent.addListener(S,"change",function(G){H=parseInt(S.value);q(L[H]);mxEvent.consume(G)});if("mxfile"==A.nodeName){var C=A.getElementsByTagName("diagram");L=[];for(var J=0;J<C.length;J++)L.push(C[J]);0<L.length&&q(L[H]);S.innerText="";if(1<L.length)for(S.style.display="",J=0;J<L.length;J++)C=document.createElement("option"),mxUtils.write(C,L[J].getAttribute("name")||mxResources.get("pageWithNumber",[J+1])),C.setAttribute("value",