Cross-site scripting (XSS) vulnerability in index.php in Flyspray 0.9.7 through 0.9.8 (devel) allows remote attackers to inject arbitrary web script or HTML via the (1) PHPSESSID (2) task (3) string (4) type (5) serv (6) due (7) dev and (8) sort2 parameters.