Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
c.appendChild(D);mxUtils.br(c);this.init=function(){D.focus();mxClient.IS_GC||mxClient.IS_FF||5<=document.documentMode?D.select():document.execCommand("selectAll",!1,null)};mxUtils.write(c,mxResources.get("top")+":");var z=document.createElement("input");z.setAttribute("type","text");z.setAttribute("size","4");z.style.marginRight="16px";z.style.marginLeft="4px";z.value=y;c.appendChild(z);mxUtils.write(c,mxResources.get("height")+":");var M=document.createElement("input");M.setAttribute("type","text");