Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function frs_show_release_popup($group_id, $name = 'release_id', $checked_val = "xzxz")
{
    /*
        return a pop-up select box of releases for the project
    */
    global $FRS_RELEASE_ID_RES,$FRS_RELEASE_NAME_RES,$Language;
    $release_factory = new FRSReleaseFactory();
    if (! $group_id) {
        return $Language->getText('file_file_utils', 'g_id_err');
    } else {
        if (! isset($FRS_RELEASE_ID_RES)) {
            $res                  = $release_factory->getFRSReleasesInfoListFromDb($group_id);
            $FRS_RELEASE_ID_RES   = [];
            $FRS_RELEASE_NAME_RES = [];
            foreach ($res as $release) {
                $FRS_RELEASE_ID_RES[]   = $release['release_id'];
                $FRS_RELEASE_NAME_RES[] = $release['package_name'] . ':' . $release['release_name'];
            }
        }
        return html_build_select_box_from_arrays($FRS_RELEASE_ID_RES, $FRS_RELEASE_NAME_RES, $name, $checked_val, false);
    }
}