Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
z.setAttribute("type","range");z.setAttribute("min","2");z.setAttribute("max","30");z.setAttribute("value",x.freehand.getBrushSize());z.style.width="90%";z.style.visibility="hidden";y.appendChild(z);mxUtils.br(y);D=function(){x.freehand.setPerfectFreehandMode(E.checked);z.style.visibility=E.checked?"visible":"hidden"};mxEvent.addListener(E,"change",D);D();mxEvent.addListener(z,"change",function(){x.freehand.setBrushSize(parseInt(this.value))})}var M=mxUtils.button(mxResources.get("startDrawing"),