Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
K.length-1);0<K.length&&za(K[E]);if(1<K.length)for(B.removeAttribute("disabled"),B.style.display="",ca=0;ca<K.length;ca++)aa=document.createElement("option"),ra=K[ca].getAttribute("name")||mxResources.get("pageWithNumber",[ca+1]),mxUtils.write(aa,ra),aa.setAttribute("title",ra+" ("+K[ca].getAttribute("id")+")"),aa.setAttribute("value",ca),ca==E&&aa.setAttribute("selected","selected"),B.appendChild(aa);H=function(){try{var ea=parseInt(B.value);E=L=ea;za(K[ea])}catch(ha){B.value=L,b.handleError(ha)}}}else Ba(ra);