Stored XSS vulnerability in Flyspray before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administrator privileges, via the realname or emailaddress field to themes/CleanFS/templates/common.editallusers.tpl.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-15213.json"