Executive brief
Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.14 allows remote attackers to inject arbitrary web script or HTML via the template argument to the /issue program.
Affected products
- PyPI roundup
Junglewise Threat Intelligence
CVE-2010-2491: PYSEC-2010-31 - Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.14 allows remote attackers to inject arbitrary web script or
CVE-2010-2491 · Severity: low · CVSS 3.1 · Published 2010-09-24
Technologies: roundup (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-744 - Roundup Improper Access Control
- PYSEC-2026-745 - Roundup Directory traversal vulnerability
- PYSEC-2025-69 - In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates (devel and responsive).
- PYSEC-2024-65 - Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents.
- PYSEC-2024-63 - In Roundup before 2.4.0, classhelpers (_generic.help.html) allow XSS.