Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
                    } elseif ($obj_attr['object_relation'] == 'last-seen' && is_null($toPush_obj['last_seen'])) {
                        $toPush_obj['last_seen'] = $obj_attr['value']; // replace last_seen of the object to seen of the element
                        $toPush_obj['last_seen_overwrite'] = true;
                    }
                    $toPush_attr = array(
                        'id' => $obj_attr['id'],
                        'uuid' => $obj_attr['uuid'],
                        'content' => $obj_attr['value'],
                        'contentType' => $obj_attr['object_relation'],
                        'event_id' => $obj_attr['event_id'],
                        'group' => 'object_attribute',
                        'timestamp' => $obj_attr['timestamp'],
                        'attribute_type' => $obj_attr['type'],
                        'date_sighting' => $sightingsAttributeMap[$attr['id']] ?? [],
                        'is_image' => $this->__eventModel->Attribute->isImage($obj_attr),
                    );
                    $toPush_obj['Attribute'][] = $toPush_attr;
                }