Language: JavaScript
Label: safe
CWE: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Code:
            success: function(data, status) {

                data = JSON.parse(data);

                if(status == "success") {

                    $(".voiceMessageTerminal").append(`<li>${data.description} is starting to send...</li>`);

                    // Start sending to first three numbers
                    var totalChanel = 2;
                    var totalContacts = data.contacts.length;
                    var maxDail = totalChanel < totalContacts ? totalChanel : totalContacts;

                    var currentPosition = maxDail;

                    for(var x=0; x<maxDail; x++ ){
                            
                        $(".voiceMessageTerminal").append(`<li class='${data.contacts[x]}'>${data.description} is sending to ${data.contacts[x]}. </li>`);
                        sendVoiceMessage(data.contacts[x], data.record, vm_id);
                        
                    }

                    if(totalContacts < 1) {
                        $(".voiceMessageTerminal").append(`<li style='color: red'>Sorry! ${data.description} has no contacts or already sent.</li>`);
                    }


                    $(document).on("initiateNextCall", function() {

                        // Mark as all contacts have daild
                        if( currentPosition === totalContacts ) {
                            
                            allContactBrodcasted = true;

                            $(".voiceMessageTerminal").append(`<li style='color: green'>${data.description} has been brodcasted to all given contacts.</li>`);

                        } else {

                            $(".voiceMessageTerminal").append(`<li class='${data.contacts[currentPosition]}'>${data.description} is sending to ${data.contacts[currentPosition]}. </li>`);
                            sendVoiceMessage(data.contacts[currentPosition], data.record, vm_id);

                            currentPosition++;

                        }

                    });

                }

            }