Medium severity5.4NVD Advisory· Published Oct 11, 2017· Updated Jun 17, 2026

CVE-2017-15214

Description

Stored XSS vulnerability in Flyspray 1.0-rc4 before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administrator privileges and also to execute JavaScript against other users (including unauthenticated users), via the name, title, or id parameter to plugins/dokuwiki/lib/plugins/changelinks/syntax.php.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Flyspray/Flyspray2 versions
cpe:2.3:a:flyspray:flyspray:1.0:rc4:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:flyspray:flyspray:1.0:rc4:*:*:*:*:*:*
- (no CPE)range: <1.0-rc6

Patches

Vulnerability mechanics

References

openwall.com/lists/oss-security/2017/10/07/1nvdMailing ListPatchThird Party AdvisoryVDB Entry
github.com/Flyspray/flyspray/commit/00cfae5661124f9d67ac6733db61b2bfee34dcccnvdPatchThird Party Advisory
github.com/Flyspray/flyspray/releases/tag/v1.0-rc6nvdRelease NotesThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000