Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxVsdxCanvas2D.prototype.curveTo=function(h,y,A,B,m,g){this.lastX=m;this.lastY=g;var b=this.state,a=this.xmGeo,c=a.height*b.scale,d=a.width*b.scale;h=(h-a.x+b.dx)*b.scale;y=(a.height-y+a.y-b.dy)*b.scale;A=(A-a.x+b.dx)*b.scale;B=(a.height-B+a.y-b.dy)*b.scale;m=(m-a.x+b.dx)*b.scale;g=(a.height-g+a.y-b.dy)*b.scale;h/=d;y/=c;A/=d;B/=c;m/=d;g/=c;this.geoSec.appendChild(this.createRowRel("RelCubBezTo",this.geoStepIndex++,m,g,h,y,A,B))};