Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
    setDefaultValue:function (defaultValue, datefield, timefield) {

        if (datefield.getValue()) {
            var dateString = Ext.Date.format(datefield.getValue(), "Y-m-d");

            if (timefield.getValue()) {
                dateString += " " + Ext.Date.format(timefield.getValue(), "H:i");
            }
            else {
                dateString += " 00:00";
            }

            defaultValue.setValue((Ext.Date.parseDate(dateString, "Y-m-d H:i").getTime())/1000);

        } else {
            defaultValue.setValue(null);
        }
    },