A vulnerability has been discovered in Flyspray, which can be exploited by malicious people to conduct cross-site scripting attacks. Input passed via the 'real_name' parameter to '/index.php?do=myprofile' is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of an affected site. The script is executed on the parameter page and on any page that allows the user to put a comment. This XSS vector allows executing scripts to gather the CSRF token and submit a form to create a new admin.