Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
x.appendChild(z);var C=document.createElement("div");C.style.marginTop="10px";if(v){var D=function(V,k,y,G,P){if(null==P||"1"!=P.html)return G=V.toLowerCase().indexOf(k,G),0>G?V:V.substr(0,G)+y+V.substr(G+k.length);var Q=V;k=mxUtils.htmlEntities(k);P=[];var U=-1;for(V=V.replace(/<br>/ig,"\n");-1<(U=V.indexOf("<",U+1));)P.push(U);U=V.match(/<[^>]*>/g);V=V.replace(/<[^>]*>/g,"");G=V.toLowerCase().indexOf(k,G);if(0>G)return Q;Q=G+k.length;y=mxUtils.htmlEntities(y);V=V.substr(0,G)+y+V.substr(Q);for(var T=
0,W=0;W<P.length;W++){if(P[W]-T<G)V=V.substr(0,P[W])+U[W]+V.substr(P[W]);else{var X=P[W]-T<Q?G+T:P[W]+(y.length-k.length);V=V.substr(0,X)+U[W]+V.substr(X)}T+=U[W].length}return V.replace(/\n/g,"<br>")},M=mxUtils.button(mxResources.get("replFind"),function(){try{if(null!=g&&null!=J){var V=J.cell,k=H.getLabel(V);H.isCellEditable(V)&&H.model.setValue(V,D(k,g,I.value,q-g.length,H.getCurrentCellStyle(V)));B.style.backgroundColor=L(!1,!0)?"":Editor.isDarkMode()?"#ff0000":"#ffcfcf"}}catch(y){b.handleError(y)}});