Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
null!=b.currentPage&&null!=b.pages&&(E=mxUtils.indexOf(b.pages,b.currentPage));for(I=e.length-1;0<=I;I--){var Q=function(V){var X=new Date(V.modifiedDate),Y=null;if(0<=X.getTime()){var Z=function(da){d.stop();x.innerText="";var ma=mxUtils.parseXml(da),ea=b.editor.extractGraphModel(ma.documentElement,!0);if(null!=ea){var za=function(Ca){null!=Ca&&(Ca=Ba(Editor.parseDiagramNode(Ca)));return Ca},Ba=function(Ca){var ba=Ca.getAttribute("background");if(null==ba||""==ba||ba==mxConstants.NONE)ba=y.defaultPageBackgroundColor;
l.style.backgroundColor=ba;(new mxCodec(Ca.ownerDocument)).decode(Ca,y.getModel());y.maxFitScale=1;y.fit(8);y.center();return Ca};N.style.display="none";N.innerText="";A=ma;H=da;D=parseSelectFunction=null;z=0;if("mxfile"==ea.nodeName){ma=ea.getElementsByTagName("diagram");D=[];for(da=0;da<ma.length;da++)D.push(ma[da]);z=Math.min(E,D.length-1);0<D.length&&za(D[z]);if(1<D.length)for(N.removeAttribute("disabled"),N.style.display="",da=0;da<D.length;da++)ma=document.createElement("option"),ea=D[da].getAttribute("name")||