Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
                        . $start->format(__('Y-m-d H:i'))
                        . ' - '
                        . '<span title="' . $end->format(__('Y-m-d')) . '">'
                        . $end->format(__('H:i'))
                        . '</span>'
                        . ', ' . round($end->copy()->diffInMinutes($start) / 60, 2) . 'h'
                        . '<br>'
                        . Room_name_render(Room::find($shift['room_id'])),
                    'title'         =>
                        ShiftType_name_render(ShiftType::find($shifttype_id))
                        . ($shift['title'] ? '<br />' . $shift['title'] : ''),
                    'needed_angels' => '',
                ];
                foreach ($types as $type) {
                    if (isset($needed_angel_types[$type->id]) && $needed_angel_types[$type->id] > 0) {
                        $shifts_table_entry['needed_angels'] .= '<b>' . AngelType_name_render($type) . ':</b> '
                            . $needed_angel_types[$type->id] . '<br />';
                    }
                }
                $shifts_table[] = $shifts_table_entry;
            }