Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
null!=b.currentPage&&null!=b.pages&&(E=mxUtils.indexOf(b.pages,b.currentPage));for(I=e.length-1;0<=I;I--){var Q=function(V){var X=new Date(V.modifiedDate),Y=null;if(0<=X.getTime()){var Z=function(da){d.stop();x.innerText="";var ma=mxUtils.parseXml(da),ea=b.editor.extractGraphModel(ma.documentElement,!0);if(null!=ea){var za=function(Ca){null!=Ca&&(Ca=Ba(Editor.parseDiagramNode(Ca)));return Ca},Ba=function(Ca){var ba=Ca.getAttribute("background");if(null==ba||""==ba||ba==mxConstants.NONE)ba=y.defaultPageBackgroundColor;