Sign in
Deutsch English Español Polski
Medium

MoinMoin Multiple cross-site scripting (XSS) vulnerabilities

  • Disclosed: 01.05.2022
  • Updated: 11.10.2026 13:17

Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin before 1.5.7 allow remote attackers to inject arbitrary web script or HTML via (1) the page info, or the page name in a (2) AttachFile, (3) RenamePage, or (4) LocalSiteMap action.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) moin < 1.5.7 1.5.7

References

CVSS score -
Weakness (CWE)
CWE-79
Platform
Python (PyPI)
Package
moin
Disclosed
01.05.2022
Updated
11.10.2026 13:17

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2026-678 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-m84w-vgwf-p893 - CC BY 4.0

Vulnerability history: moin

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (41) in the archive
Total entries
41
First → latest
04.2008 05.2022
Without a fix
5
Exploited in attacks
0

Severity breakdown

  • High 11
  • Medium 30

Disclosures per year

earlier: 23

Severity:
  1. MoinMoin Multiple cross-site scripting (XSS) vulnerabilities this entry
    Medium CVE-2007-0857 < 1.5.7 1.5.7
  2. MoinMoin Improper Privilege Management
    High CVE-2004-1463 < 1.2.3 1.2.3
  3. MoinMoin Improper Access Control
    High CVE-2004-1462 < 1.2.3 1.2.3
  4. MoinMoin allows administrative access
    High CVE-2004-0708 < 1.2.2 1.2.2
  5. MoinMoin vulnerable to remote code execution via cache action
    High · 8.8 CVE-2020-25074 < 1.9.11 1.9.11
  6. MoinMoin 1.7.x before 1.7.3 and 1.8.x before 1.8.3 checks parent ACLs in certain inappropriate circumstances during processing of hierarchical ACLs, which allows remote attackers to bypass intended ac
    High · 7.5 CVE-2009-4762 >= 1.7, < 1.7.3, >= 1.8, < 1.8.3 1.7.3, 1.8.3
  7. MoinMoin before 1.8.7 and 1.9.x before 1.9.2 does not properly sanitize user profiles, which has unspecified impact and attack vectors.
    High CVE-2010-0669 < 1.8.7, >= 1.9, < 1.9.2 1.8.7, 1.9.2
  8. The default configuration of cfg.packagepages_actions_excluded in MoinMoin before 1.8.7 does not prevent unsafe package actions, which has unspecified impact and attack vectors.
    High CVE-2010-0717 < 1.8.7 1.8.7
  9. MoinMoin 1.9 before 1.9.1 does not perform the expected clearing of the sys.argv array in situations where the GATEWAY_INTERFACE environment variable is set, which allows remote attackers to obtain se
    High · 7.5 CVE-2010-0667 >= 1.9, < 1.9.1 1.9.1
  10. MoinMoin 1.6.2 and 1.7 does not properly enforce ACL checks when acl_hierarchic is set to True, which might allow remote attackers to bypass intended access restrictions, a different vulnerability tha
    High · 7.5 CVE-2008-6603 < 1.6.3, >= 1.7, < 1.7.1 1.6.3, 1.7.1
  11. MoinMoin Denial of Service vulnerability via password_checker function
    High · 7.5 CVE-2008-6549 < 1.6.1 1.6.1
  12. The user form processing (userform.py) in MoinMoin before 1.6.3, when using ACLs or a non-empty superusers list, does not properly manage users, which allows remote attackers to gain privileges.
    High · 7.5 CVE-2008-1937 < 1.6.3, >= 1.7, < 1.7.1 1.6.3, 1.7.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.