Skip to content

CVE-2012-6130

Roundup Cross-site Scripting (XSS) vulnerability

4.3 MediumFix available

CVE-2012-6130 is a medium vulnerability (CVSS 4.3) in Roundup-tracker Roundup, published April 11, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.00%, the 80th percentile. Fixed in roundup 1.4.20.

Cross-site scripting (XSS) vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via a username, related to generating a link.

Exploit likelihood

2.00%Up 0.7 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Cross-site scripting (XSS) vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via a username, related to generating a link.

Record: CVE-2012-6130
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Cross-site scripting (XSS) vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via a username, related to generating a link.

Record: CVE-2012-6130
Updated: 2026-11-02

EUVDEUVD-2014-0099 No score

Cross-site scripting (XSS) vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via a username, related to generating a link.

Record: EUVD-2014-0099
Updated: 2026-11-03

GitHub AdvisoriesGHSA-mccq-3m7h-fjxg 5.3

Roundup Cross-site Scripting (XSS) vulnerability

Cross-site scripting (XSS) vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via a username, related to generating a link.

Record: GHSA-mccq-3m7h-fjxg
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness: CWE-79
Updated: 2026-11-02

OSVGHSA-mccq-3m7h-fjxg 5.3

Roundup Cross-site Scripting (XSS) vulnerability

Cross-site scripting (XSS) vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via a username, related to generating a link.

Record: GHSA-mccq-3m7h-fjxg
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness: CWE-79
Updated: 2026-11-02

OSVPYSEC-2014-15 No score

Cross-site scripting (XSS) vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via a username, related to generating a link.

Record: PYSEC-2014-15
Updated: 2026-11-02

Affected products

roundup-tracker roundup

Affected packages

Affected packages
Package	Affected	Fixed
`roundup` PyPI	before 1.4.20	1.4.20
`roundup` Debian:6.0	before 1.4.15-3+deb6u1, plus listed versions 1.4.15-3	1.4.15-3+deb6u1
`roundup` PyPI	before 1.4.20, plus listed versions 0.5.90.6.110.6.80.6.90.7.0 Show 45 moreShow less 0.7.0b30.7.10.7.110.7.120.7.20.7.30.7.40.7.50.7.70.7.80.7.90.8.00.8.0b10.8.10.8.20.8.30.8.40.8.50.8.60.9.0b11.01.0.11.1.01.1.11.1.21.2.01.2.11.3.01.3.11.3.21.3.31.4.01.4.11.4.101.4.111.4.121.4.131.4.141.4.151.4.161.4.171.4.181.4.191.4.21.4.3	1.4.20

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 4 moreShow less

This page doesn't list everything

Left out here: 6 versions. The JSON record has them.