Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
ua,va,Ea,Da,Ta,Ia){if(0<Da){var Sa=Array(Da);ua=null!=ua?ua.split(","):[];for(var Ha=0;Ha<Da;Ha++)Sa[Ha]=null!=ua[Ha]?ua[Ha]:null!=Ea?Ea:"";ha.push({name:pa,values:Sa,type:va,defVal:Ea,parentRow:Ta,flipBkg:Ia,size:Da})}return document.createElement("div")}function X(pa,ua,va){var Ea=document.createElement("input");Ea.type="checkbox";Ea.checked="1"==ua;mxEvent.addListener(Ea,"change",function(){P(pa,Ea.checked?"1":"0",va)});return Ea}function Y(pa,ua,va,Ea,Da){var Ta=va.dispName,Ia=va.type,Sa=document.createElement("tr");