Roundup Cross-site Scripting Vulnerability

Description

References

• nvd.nist.gov/vuln/detail/CVE-2024-39125 · ADVISORY
• roundup-tracker/roundup commit 860e3c8 · WEB
• pypa/advisory-database · WEB
• roundup-tracker/roundup · PACKAGE
• roundup-tracker.org · WEB
• roundup-tracker.org/docs/security.html · WEB
• GitHub Advisory GHSA-xjgw-ghrx-wfff · ADVISORY

More vulnerabilities in roundup

• CVE-2025-53865MEDIUM 6.4In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates (devel and responsive).
• CVE-2024-39126MEDIUM 5.4Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents.
• CVE-2024-39124MEDIUM 5.4In Roundup before 2.4.0, classhelpers (_generic.help.html) allow XSS.
• CVE-2012-6133MEDIUM 6.1Multiple cross-site scripting (XSS) vulnerabilities in Roundup before 1.4.20 allow remote attackers to inject arbitrary web script or HTML v…
• CVE-2019-10904MEDIUM 6.1Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi_handler.py mishandle 404 errors.