What’s Vulnerable › Vulnerabilities

CVE-2017-15213

• Severity: medium (CVSS 5.4 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-10-11 · updated 2026-06-17
• Weakness: CWE-79

Description

Stored XSS vulnerability in Flyspray before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administrator privileges, via the real_name or email_address field to themes/CleanFS/templates/common.editallusers.tpl.

Affected products

• Flyspray: through 1.0

References

• http://openwall.com/lists/oss-security/2017/10/07/1
• https://github.com/Flyspray/flyspray/commit/754ec5d04348ef7ecb8cb02ade976dc412b031f8
• https://github.com/Flyspray/flyspray/releases/tag/v1.0-rc6
• http://openwall.com/lists/oss-security/2017/10/07/1
• https://github.com/Flyspray/flyspray/commit/754ec5d04348ef7ecb8cb02ade976dc412b031f8
• https://github.com/Flyspray/flyspray/releases/tag/v1.0-rc6

Get alerted when CVE-2017-15213 or the next vulnerability affects your stack