CVE-2012-6130: Cross-site scripting (XSS) vulnerability in the history display in Roundup before 1.4.20 allows remote atta...

Security readout for executives and security teams

Roundup issue trackers before 1.4.20 could display a malicious username as executable web content in the history view. If a user viewed affected history content, attacker-controlled script could run in that user’s browser. The sources do not provide CVSS, broad product metadata, or evidence of current exploitation. Exposure is most likely where Roundup before 1.4.20 remains deployed, especially if user registration or username changes involve untrusted users. The provided affected-product metadata is incomplete, so teams should validate actual Roundup package and application versions rather than relying on CPE matching. Handle as a moderate-priority legacy web application risk. It is not marked as actively exploited in the provided sources, but exposed outdated Roundup systems could let attackers run script in users’ browsers, creating session, trust, and workflow risks. Mitigation focus: Upgrade Roundup deployments to version 1.4.20 or later.; Review Roundup and distribution advisories for supported backported fixes.; Restrict untrusted access to vulnerable Roundup instances until remediated..

Prepared

Jun 14, 2026, 14:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.