Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxVsdxCanvas2D.prototype.moveTo=function(h,y){1<this.geoStepIndex&&this.createGeoSec();this.lastMoveToX=h;this.lastMoveToY=y;this.lastX=h;this.lastY=y;var A=this.xmGeo,B=this.state;h=(h-A.x+B.dx)*B.scale;y=(A.height-y+A.y-B.dy)*B.scale;var m=A.height*B.scale;A=A.width*B.scale;this.geoSec.appendChild(this.createRowRel("RelMoveTo",this.geoStepIndex++,h/A,y/m))};