Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"1",R));vb.appendChild(b("NameUniv",Za[yb].name,R));vb.appendChild(b("ColorTrans","0",R))}sa.appendChild(ka);qa.appendChild(sa);qa.appendChild(Fa);X.appendChild(qa);qa=A(ha,J.RELS_XMLNS,"Relationship");qa.setAttribute("Id","rId"+V);qa.setAttribute("Type",J.PAGES_TYPE);qa.setAttribute("Target",ca);T.appendChild(qa);z(H,J.VISIO_PAGES+ca,K[oa]);V++}R.appendChild(X);ha.appendChild(T);z(H,J.VISIO_PAGES+"pages.xml",R);z(H,J.VISIO_PAGES+"_rels/pages.xml.rels",ha)}function I(H,K){K=J.VISIO_PAGES_RELS+"page"+
K+".xml.rels";var P=mxUtils.createXmlDocument(),Q=A(P,J.RELS_XMLNS,"Relationships"),R=A(P,J.RELS_XMLNS,"Relationship");R.setAttribute("Type","http://schemas.microsoft.com/visio/2010/relationships/master");R.setAttribute("Id","rId1");R.setAttribute("Target","../masters/master1.xml");Q.appendChild(R);var ha=O.images;if(0<ha.length)for(var X=0;X<ha.length;X++)R=A(P,J.RELS_XMLNS,"Relationship"),R.setAttribute("Type",J.XMLNS_R+"/image"),R.setAttribute("Id","rId"+(X+2)),R.setAttribute("Target","../media/"+
ha[X]),Q.appendChild(R);P.appendChild(Q);z(H,K,P)}var J=this,O=new mxVsdxCanvas2D,M={},L=1;this.exportCurrentDiagrams=function(H){try{if(h.spinner.spin(document.body,mxResources.get("exporting"))){var K=function(Fa,ka){Fa=Fa.model.getChildCells(Fa.model.root);R[ka]=[];for(var Za=0;Za<Fa.length;Za++)Fa[Za].visible&&R[ka].push({name:Fa[Za].value||"Background",visible:Fa[Za].visible,locked:Fa[Za].style&&0<=Fa[Za].style.indexOf("locked=1")})},P=new JSZip;O.init(P);M={};L=1;var Q={},R={},ha={},X=null!=