Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function AngelType_view(
    AngelType $angeltype,
    $members,
    ?UserAngelType $user_angeltype,
    $admin_user_angeltypes,
    $admin_angeltypes,
    $supporter,
    $user_driver_license,
    $user,
    ShiftsFilterRenderer $shiftsFilterRenderer,
    ShiftCalendarRenderer $shiftCalendarRenderer,
    $tab
) {
    return page_with_title(sprintf(__('Team %s'), $angeltype->name), [
        AngelType_view_buttons($angeltype, $user_angeltype, $admin_angeltypes, $supporter, $user_driver_license, $user),
        msg(),
        tabs([
            __('Info')   => AngelType_view_info(
                $angeltype,
                $members,
                $admin_user_angeltypes,
                $admin_angeltypes,
                $supporter
            ),
            __('Shifts') => AngelType_view_shifts(
                $angeltype,
                $shiftsFilterRenderer,
                $shiftCalendarRenderer
            ),
        ], $tab),
    ], true);
}