Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi_handler.py mishandle 404 errors. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
XSS
Debian
Debian Linux
Roundup
Roundup Tracker
NVD
GitHub
CVSS 3.0
6.1
EPSS
1.6%