Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Z?new mxPoint(V,Z):new mxPoint(mxEvent.getClientX(C),mxEvent.getClientY(C)),Q=ba,ba=b.zoomFactor,V=null,C.ctrlKey&&null!=C.deltaY&&40>Math.abs(C.deltaY)&&Math.round(C.deltaY)!=C.deltaY?ba=1+Math.abs(C.deltaY)/20*(ba-1):null!=C.movementY&&"pointermove"==C.type&&(ba=1+Math.max(1,Math.abs(C.movementY))/20*(ba-1),V=-1),b.lazyZoom(M,null,V,ba),mxEvent.consume(C),!1;aa=aa.parentNode}}),b.container);b.panningHandler.zoomGraph=function(C){b.cumulativeZoomFactor=C.scale;b.lazyZoom(0<C.scale,!0);mxEvent.consume(C)}};