CVE-2008-1166: Flyspray

Medium severity, CVSS 5.0. EPSS: 1.2% chance of exploitation in the next 30 days.

Flyspray 0.9.9.4 generates different error messages depending on whether the username is valid or invalid, which allows remote attackers to enumerate usernames.

Affected products

• Flyspray Flyspray: version 0.9.9 only; version 0.9.9.1 only; version 0.9.9.2 only; version 0.9.9.3 only; version 0.9.9.4 only

Published 2008-03-05. Last modified 2026-06-16.