Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
O.setAttribute("title",mxResources.get("create")+"...");mxEvent.addListener(O,"click",function(ca){function ia(){K(ma,aa,function(la){G(aa);b.addComment(la,function(X){la.id=X;ja.push(la);R(aa)},function(X){L(aa);ia();b.handleError(X,null,null,null,mxUtils.htmlEntities(mxResources.get("objectNotFound")))})},!0)}var ma=b.newComment("",b.getCurrentUser()),aa=V(ma,ja,null,0);ia();ca.preventDefault();mxEvent.consume(ca)});M.appendChild(O)}O=A.cloneNode();O.innerHTML='<img class="geAdaptiveAsset" src="'+