Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
    function createSearch() {
        global $thisstaff;

        if (!$thisstaff)
            Http::response(403, 'Agent login is required');


        $search = SavedSearch::create(array(
                    'title' => __('Add Queue'),
                    'root' => 'T',
                    'staff_id' => $thisstaff->getId(),
                    'parent_id' =>  $_GET['pid'],
                    ));
        $this->_tryAgain($search);
    }