Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
                $toPush = array(
                    'id' => $attr['id'],
                    'uuid' => $attr['uuid'],
                    'content' => $attr['value'],
                    'event_id' => $attr['event_id'],
                    'group' => 'attribute',
                    'timestamp' => $attr['timestamp'],
                    'first_seen' => $attr['first_seen'],
                    'last_seen' => $attr['last_seen'],
                    'attribute_type' => $attr['type'],
                    'date_sighting' => $sightingsAttributeMap[$attr['id']] ?? [],
                    'is_image' => $this->__eventModel->Attribute->isImage($attr),
                );
                $this->__json['items'][] = $toPush;
            }