Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.pm.initialise(this.rootElement,this);this.initStylesheets();this.initThemes();this.initMasters();this.initPages()}g.prototype.initThemes=function(){if(null!=this.xmlDocs)for(var b=!0,a=1;b;){var c=function(f,k){return f[k]?f[k]:null}(this.xmlDocs,h.mxgraph.io.mxVsdxCodec.vsdxPlaceholder+"/theme/theme"+a+".xml");if(null!=c){for(c=c.firstChild;null!=c;){if(null!=c&&1==c.nodeType&&function(f,k){return f&&f.equals?f.equals(k):f===k}(c.tagName,"a:theme")){c=new h.mxgraph.io.vsdx.mxVsdxTheme(c);0>