Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function Shift_view_header(Shift $shift, Room $room)
{
    return div('row', [
        div('col-sm-3 col-xs-6', [
            '<h4>' . __('Title') . '</h4>',
            '<p class="lead">'
            . ($shift->url != ''
                ? '<a href="' . $shift->url . '">' . $shift->title . '</a>'
                : $shift->title)
            . '</p>',
        ]),
        div('col-sm-3 col-xs-6', [
            '<h4>' . __('Start') . '</h4>',
            '<p class="lead' . (time() >= $shift->start->timestamp ? ' text-success' : '') . '">',
            icon('calendar-event') . $shift->start->format(__('Y-m-d')),
            '<br />',
            icon('clock') . $shift->start->format('H:i'),
            '</p>',
        ]),