Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
var q=new Spinner({left:"50%",lines:12,length:8,width:3,radius:5,rotate:0,color:"#000",speed:1,trail:60,shadow:!1,hwaccel:!1,className:"spinner",zIndex:2E9}),C=new Editor,J=null,G=null,P=null,O=!1,N=[],T=null,m=null;this.getSelectedItem=function(){null!=G&&l(G);return G};if(null==g("#mxODPickerCss")){var B=document.head||document.getElementsByTagName("head")[0],K=document.createElement("style");B.appendChild(K);K.type="text/css";K.id="mxODPickerCss";K.appendChild(document.createTextNode(p))}b.innerHTML=