Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function n(D){null!=D&&(D=l(Editor.parseDiagramNode(D)));return D}mxEvent.addListener(S,"change",function(D){B=parseInt(S.value);n(I[B]);mxEvent.consume(D)});if("mxfile"==x.nodeName){var z=x.getElementsByTagName("diagram");I=[];for(var C=0;C<z.length;C++)I.push(z[C]);0<I.length&&n(I[B]);S.innerText="";if(1<I.length)for(S.style.display="",C=0;C<I.length;C++)z=document.createElement("option"),mxUtils.write(z,I[C].getAttribute("name")||mxResources.get("pageWithNumber",[C+1])),z.setAttribute("value",