Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
!l){var K=function(){G.value=Math.max(1,Math.min(D,Math.max(parseInt(G.value),parseInt(k.value))));k.value=Math.max(1,Math.min(D,Math.min(parseInt(G.value),parseInt(k.value))))},O=d.addRadiobox(n,"pages",mxResources.get("allPages"),!0),V=d.addRadiobox(n,"pages",mxResources.get("pages")+":",!1,null,!0),k=document.createElement("input");k.style.cssText="margin:0 8px 0 8px;";k.setAttribute("value","1");k.setAttribute("type","number");k.setAttribute("min","1");k.style.width="50px";n.appendChild(k);var y=