Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
		function read_gps_location($file)
		{
			if (is_file($file)) {
				$exif = exif_read_data($file);
				if (
					isset($exif['GPSLatitude']) && isset($exif['GPSLongitude']) &&
					isset($exif['GPSLatitudeRef']) && isset($exif['GPSLongitudeRef']) &&
					in_array($exif['GPSLatitudeRef'], array('E', 'W', 'N', 'S')) && in_array($exif['GPSLongitudeRef'], array('E', 'W', 'N', 'S'))
				) {

					$GPSLatitudeRef	 = strtolower(trim($exif['GPSLatitudeRef']));
					$GPSLongitudeRef = strtolower(trim($exif['GPSLongitudeRef']));

					$lat_degrees_a = explode('/', $exif['GPSLatitude'][0]);
					$lat_minutes_a = explode('/', $exif['GPSLatitude'][1]);
					$lat_seconds_a = explode('/', $exif['GPSLatitude'][2]);
					$lon_degrees_a = explode('/', $exif['GPSLongitude'][0]);
					$lon_minutes_a = explode('/', $exif['GPSLongitude'][1]);
					$lon_seconds_a = explode('/', $exif['GPSLongitude'][2]);

					$lat_degrees = $lat_degrees_a[0] / $lat_degrees_a[1];
					$lat_minutes = $lat_minutes_a[0] / $lat_minutes_a[1];
					$lat_seconds = $lat_seconds_a[0] / $lat_seconds_a[1];
					$lon_degrees = $lon_degrees_a[0] / $lon_degrees_a[1];
					$lon_minutes = $lon_minutes_a[0] / $lon_minutes_a[1];
					$lon_seconds = $lon_seconds_a[0] / $lon_seconds_a[1];

					$lat = (float) $lat_degrees + ((($lat_minutes * 60) + ($lat_seconds)) / 3600);
					$lon = (float) $lon_degrees + ((($lon_minutes * 60) + ($lon_seconds)) / 3600);

					// If the latitude is South, make it negative
					// If the longitude is west, make it negative
					$GPSLatitudeRef	 == 's' ? $lat *= -1 : '';
					$GPSLongitudeRef == 'w' ? $lon *= -1 : '';

					return array(
						'lat' => $lat,
						'lon' => $lon
					);
				}
			}
			return false;
		}