CVE-2012-6132
Roundup Cross-site Scripting (XSS) vulnerability
CVE-2012-6132 is a medium vulnerability (CVSS 4.3) in Roundup-tracker Roundup, published April 10, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.85%, the 79th percentile. Fixed in roundup 1.4.20.
Cross-site scripting (XSS) vulnerability in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the otk parameter.
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the otk parameter.
- Record
CVE-2012-6132- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the otk parameter.
- Record
CVE-2012-6132- Updated
- 2026-11-02
EUVDEUVD-2014-0101 No score
Cross-site scripting (XSS) vulnerability in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the otk parameter.
- Record
EUVD-2014-0101- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5v6q-xqq8-g4xj
Roundup Cross-site Scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the otk parameter.
- Record
GHSA-5v6q-xqq8-g4xj- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-5v6q-xqq8-g4xj
Roundup Cross-site Scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the otk parameter.
- Record
GHSA-5v6q-xqq8-g4xj- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVPYSEC-2014-96 No score
Cross-site scripting (XSS) vulnerability in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the otk parameter.
- Record
PYSEC-2014-96- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
roundupPyPI |
before 1.4.20 | 1.4.20 |
roundupDebian:6.0 |
before 1.4.15-3+deb6u1, plus listed versions 1.4.15-3 |
1.4.15-3+deb6u1 |
roundupPyPI |
before 1.4.20, plus listed versions 0.5.90.6.110.6.80.6.90.7.0 Show 45 moreShow less0.7.0b30.7.10.7.110.7.120.7.20.7.30.7.40.7.50.7.70.7.80.7.90.8.00.8.0b10.8.10.8.20.8.30.8.40.8.50.8.60.9.0b11.01.0.11.1.01.1.11.1.21.2.01.2.11.3.01.3.11.3.21.3.31.4.01.4.11.4.101.4.111.4.121.4.131.4.141.4.151.4.161.4.171.4.181.4.191.4.21.4.3 |
1.4.20 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
bugzilla.redhat.com/show_bug.cgi?id=722672
openwall.com/lists/oss-security/2013/02/13/8
exchange.xforce.ibmcloud.com/vulnerabilities/84191
nvd.nist.gov/vuln/detail/CVE-2012-6132
github.com/pypa/advisory-database/tree/main/vulns/roundup/PYSEC-2014-96.yaml
Left out here: 6 versions. The JSON record has them.