This works: http://docs.pythonweb.org/spaces/usage/report.action?key=pylonscookbook

• I change the date with a link to get: http://docs.pythonweb.org/spaces/usage/report.action?key=pylonscookbook&period=week&date=20070311

XSS:

• period=HTML_HERE
  http://docs.pythonweb.org/spaces/usage/report.action?key=pylonscookbook&period=<script>alert("lol")</script>&date=20070311

Exception throwing:

• date=NOT_A_NUMBER
  http://docs.pythonweb.org/spaces/usage/report.action?key=pylonscookbook&period=week&date=LOL

• Also the exception page does not encode HTML tags so this will work:
  http://docs.pythonweb.org/spaces/usage/report.action?key=pylonscookbook&period=week&date=LOL<script>alert("lol")</script>