Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
":");var A="#0000ff",H=null;H=mxUtils.button("",mxUtils.bind(this,function(J){this.pickColor(A||"none",function(O){A=O;k()});mxEvent.consume(J)}));k();H.style.padding=mxClient.IS_FF?"4px 2px 4px 2px":"4px";H.style.marginLeft="4px";H.style.height="22px";H.style.width="22px";H.style.position="relative";H.style.top=mxClient.IS_IE||mxClient.IS_IE11||mxClient.IS_EDGE?"6px":"1px";H.className="geColorBtn";d.appendChild(H);mxUtils.br(d);return{getColor:function(){return A},getTarget:function(){return v.value},