CVE-2007-6461: Multiple cross-site scripting (XSS) vulnerabilities in index.php in Flyspray 0.9.9 through 0.9.9.3 allow re...

Security readout for executives and security teams

This issue affects old Flyspray 0.9.9 to 0.9.9.3 installations. A remote attacker could inject script or HTML into pages viewed by users, potentially enabling session theft, account actions in a victim’s browser, or misleading content. The source bundle does not show active exploitation or a named fixed version. Exposure is most likely in legacy, internet-accessible Flyspray deployments running versions 0.9.9 through 0.9.9.3. Systems behind authentication may still be exposed if attackers can deliver crafted links to authenticated users. Evidence is insufficient to name other affected products or versions. Treat this as a legacy web-application exposure review item. It is not supported by KEV or active exploitation evidence, but public-facing vulnerable Flyspray instances could create account and trust risks through browser-side script execution. Mitigation focus: Inventory Flyspray instances and identify any versions 0.9.9 through 0.9.9.3.; Check Flyspray vendor advisory fsa:2 for fixed-version or upgrade guidance.; Retire or isolate unsupported legacy Flyspray installations..

Prepared

Jun 28, 2026, 19:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.