Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
parentRow:Qa,isDeletable:!0,flipBkg:Fa}));btn=mxUtils.button("+",mxUtils.bind(Z,function(Ra){for(var Ga=Qa,Va=0;null!=Ga.nextSibling;)if(Ga.nextSibling.getAttribute("data-pName")==oa)Ga=Ga.nextSibling,Va++;else break;var Ua={type:va,parentRow:Qa,index:Va,isDeletable:!0,defVal:Ea,countProperty:Da};Va=Y(oa,"",Ua,0==Va%2,Fa);R(oa,Ea,Ua);Ga.parentNode.insertBefore(Va,Ga.nextSibling);mxEvent.consume(Ra)}));btn.style.height="16px";btn.style.width="25px";btn.className="geColorBtn";return btn}function V(oa,
sa,va,Ea,Da,Qa,Fa){if(0<Da){var Ra=Array(Da);sa=null!=sa?sa.split(","):[];for(var Ga=0;Ga<Da;Ga++)Ra[Ga]=null!=sa[Ga]?sa[Ga]:null!=Ea?Ea:"";da.push({name:oa,values:Ra,type:va,defVal:Ea,parentRow:Qa,flipBkg:Fa,size:Da})}return document.createElement("div")}function X(oa,sa,va){var Ea=document.createElement("input");Ea.type="checkbox";Ea.checked="1"==sa;mxEvent.addListener(Ea,"change",function(){R(oa,Ea.checked?"1":"0",va)});return Ea}function Y(oa,sa,va,Ea,Da){var Qa=va.dispName,Fa=va.type,Ra=document.createElement("tr");