Medium severity5.4OSV Advisory· Published Oct 11, 2017· Updated Jun 17, 2026

CVE-2017-15213

Description

Stored XSS vulnerability in Flyspray before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administrator privileges, via the real_name or email_address field to themes/CleanFS/templates/common.editallusers.tpl.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Flyspray/FlysprayOSV3 versions
v1.0-beta, v1.0-rc, v1.0-rc2, …+ 2 more
- (no CPE)range: v1.0-beta, v1.0-rc, v1.0-rc2, …
- cpe:2.3:a:flyspray:flyspray:*:rc4:*:*:*:*:*:*range: <=1.0
- (no CPE)range: <1.0-rc6

Patches

Vulnerability mechanics

References

openwall.com/lists/oss-security/2017/10/07/1nvdMailing ListPatchThird Party AdvisoryVDB Entry
github.com/Flyspray/flyspray/commit/754ec5d04348ef7ecb8cb02ade976dc412b031f8nvdPatchThird Party Advisory
github.com/Flyspray/flyspray/releases/tag/v1.0-rc6nvdRelease NotesThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000