Description
Cross-site scripting (XSS) vulnerability in index.php in Flyspray 0.9.7 through 0.9.8 (devel) allows remote attackers to inject arbitrary web script or HTML via the (1) PHPSESSID, (2) task, (3) string, (4) type, (5) serv, (6) due, (7) dev, and (8) sort2 parameters.
Exploits (1)
References (8)
Core 8
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/22889
Various Sources x_refsource_confirm
http://flyspray.rocks.cc/bts/task/703
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/15209
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/18606
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2006/dsa-953
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/17316
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://www.osvdb.org/20326
Exploit, Vendor Advisory x_refsource_misc
http://lostmon.blogspot.com/2005/10/flyspray-bug-killer-multiple-variable.html
Scores
EPSS
0.1024
EPSS Percentile
93.2%
Details
Status
published
Products (2)
flyspray/flyspray
0.9.7
flyspray/flyspray
0.9.8 (2 CPE variants)
Published
Oct 27, 2005
Tracked Since
Feb 18, 2026