Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
    public function uploadForm($filename, $allowed_size = 0, $destination = false) {

        $source     = $_FILES[$filename]['tmp_name'];
        $error_code = $_FILES[$filename]['error'];
        $dest_size  = (int) $_FILES[$filename]['size'];
        $dest_name  = files_sanitize_name($_FILES[$filename]['name']);

        $file = new cmsUploadfile($source, $this->allowed_mime);

        if (!$file->isAllowed()) {
            return [
                'error'   => LANG_UPLOAD_ERR_MIME . '. ' . sprintf(LANG_PARSER_FILE_EXTS_FIELD_HINT, implode(', ', $this->allowed_mime_ext)),
                'success' => false,
                'name'    => $dest_name
            ];
        }

        if ($allowed_size) {
            if ($dest_size > $allowed_size) {
                return [
                    'error'   => sprintf(LANG_UPLOAD_ERR_INI_SIZE, files_format_bytes($allowed_size)),
                    'success' => false,
                    'name'    => $dest_name
                ];
            }
        }

        $dest_ext = $file->getExt();

        if (!$destination) {
            $destination = $this->getUploadDestinationDirectory();
        } else {
            $destination = $this->site_cfg->upload_path . $destination . '/';
        }

        if (!$this->file_name) {
            $this->file_name = pathinfo($dest_name, PATHINFO_FILENAME);
        }

        $destination .= $this->getFileName($destination, $dest_ext);

        return $this->moveUploadedFile($source, $destination, $error_code, $dest_name, $dest_size);
    }