Roundup-Tracker

14 CVEs across 1 Roundup-Tracker products. Browse Roundup-Tracker vulnerabilities, severities, and proof-of-concept exploits.

Roundup-Tracker products with known CVEs

ProductCVEs
Roundup14
Roundup-Tracker CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2025-53865Medium6.42025-07-13In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates (devel and responsive).
CVE-2024-39126Medium5.42024-07-17Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents.
CVE-2024-39125Medium5.42024-07-17Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header.
CVE-2024-39124Medium5.42024-07-17In Roundup before 2.4.0, classhelpers (_generic.help.html) allow XSS.
CVE-2012-6133Medium6.12020-01-30Multiple cross-site scripting (XSS) vulnerabilities in Roundup before 1.4.20 allow remote attackers to inject arbitrary web script or HTML via the (1) @ok_mess…
CVE-2019-10904Medium6.12019-04-06Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi_handler.py mishandle 404 errors.
CVE-2014-6276Medium4.32016-04-13schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote authenticated users to obta…
CVE-2012-61312014-04-11Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the @acti…
CVE-2012-61302014-04-11Cross-site scripting (XSS) vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via a u…
CVE-2012-61322014-04-10Cross-site scripting (XSS) vulnerability in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the otk parameter.
CVE-2010-24912010-09-24Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.14 allows remote attackers to inject arbitrary web script or HTML via the templ…
CVE-2008-14752008-03-24The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read restricted properties v…
CVE-2008-14742008-03-24Multiple unspecified vulnerabilities in Roundup before 1.4.4 have unknown impact and attack vectors, some of which may be related to cross-site scripting (XSS).
CVE-2004-14442004-12-31Directory traversal vulnerability in Roundup 0.6.4 and earlier allows remote attackers to view arbitrary files via .. (dot dot) sequences in an @@ command in a…