Language: JavaScript
Label: safe
CWE: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Code:
function updateCallLog({vm_id="", number="", duration="", status=""}="") {

    
    $.ajax({
        url: full_website_address + "/xhr/?module=customer-support&page=updateCallLog",
        type: "post",
        data:{
            vm_id: vm_id,
            number: number,
            duration: duration,
            status: status
        },
        success: function(status, data){}

    });

}