Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
                url: Routing.generate('pimcore_ecommerceframework_pricing_delete'),
                method: 'DELETE',
                params: {
                    id: record.id
                },
                success: function () {
                    this.refresh(this.tree.getRootNode());
                }.bind(this)
            });
        }.bind(this));

    },