Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
var D=0,M=0,K=J.geometry,O=mxUtils.format((C.geometry.x+3-K.x)/K.width);C=mxUtils.format((C.geometry.y+3-K.y)/K.height);0>O?(D=O*K.width,O=0):1<O&&(D=(O-1)*K.width,O=1);0>C?(M=C*K.height,C=0):1<C&&(M=(C-1)*K.height,C=1);return{x:O,y:C,dx:parseInt(D),dy:parseInt(M)}}function N(C){if(1==R.getSelectionCount()){var D=R.getSelectionCell();C&&(D.constObj=null);C=L(D);S.value=100*C.x;n.value=100*C.y;l.value=C.dx;z.value=C.dy;A.style.visibility=""}else A.style.visibility="hidden"}var H=document.createElement("div");