CVE-2009-0260
MoinMoin Multiple cross-site scripting (XSS) vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin before 1.8.1 allow remote attackers to inject arbitrary web script or HTML via an AttachFile action to the WikiSandBox component with (1) the rename parameter or (2) the drawing parameter (aka the basename variable).
Exploit likelihood
What each source reports
NVD Score used
Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin before 1.8.1 allow remote attackers to inject arbitrary web script or HTML via an AttachFile action to the WikiSandBox component with (1) the rename parameter or (2) the drawing parameter (aka the basename variable).
- Record
CVE-2009-0260- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin before 1.8.1 allow remote attackers to inject arbitrary web script or HTML via an AttachFile action to the WikiSandBox component with (1) the rename parameter or (2) the drawing parameter (aka the basename variable).
- Record
CVE-2009-0260- Updated
- 2026-11-02
EUVDEUVD-2022-3012 No score
Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin before 1.8.1 allow remote attackers to inject arbitrary web script or HTML via an AttachFile action to the WikiSandBox component with (1) the rename parameter or (2) the drawing parameter (aka the basename variable).
- Record
EUVD-2022-3012- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7hjm-hqgj-xv9f No score
MoinMoin Multiple cross-site scripting (XSS) vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin before 1.8.1 allow remote attackers to inject arbitrary web script or HTML via an AttachFile action to the WikiSandBox component with (1) the rename parameter or (2) the drawing parameter (aka the basename variable).
- Record
GHSA-7hjm-hqgj-xv9f- Weakness
- CWE-79
- Updated
- 2026-11-02
OSV No score
Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin before 1.8.1 allow remote attackers to inject arbitrary web script or HTML via an AttachFile action to the WikiSandBox component with (1) the rename parameter or (2) the drawing parameter (aka the basename variable).
- Record
CVE-2009-0260- Updated
- 2026-11-02
OSVGHSA-7hjm-hqgj-xv9f No score
MoinMoin Multiple cross-site scripting (XSS) vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin before 1.8.1 allow remote attackers to inject arbitrary web script or HTML via an AttachFile action to the WikiSandBox component with (1) the rename parameter or (2) the drawing parameter (aka the basename variable).
- Record
GHSA-7hjm-hqgj-xv9f- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVPYSEC-2026-670 No score
MoinMoin Multiple cross-site scripting (XSS) vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin before 1.8.1 allow remote attackers to inject arbitrary web script or HTML via an AttachFile action to the WikiSandBox component with (1) the rename parameter or (2) the drawing parameter (aka the basename variable).
- Record
PYSEC-2026-670- Updated
- 2026-11-02
Affected products
Affected packages
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | MoinMoin 1.8 - 'AttachFile.py' Cross-Site Scripting | 2009-01-20 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-0260 is a medium vulnerability (CVSS 4.3) in Moinmoin, published January 23, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 5.48%, the 92nd percentile. Fixed in moin 1.8.1.
References
secunia.com/advisories/33593
vupen.com/english/advisories/2009/0195
moinmo.in/SecurityFixes
securityfocus.com/bid/33365
Show 10 moreShow less
osvdb.org/51485
hg.moinmo.in/moin/1.8/rev/8cb4d34ccbc1
exchange.xforce.ibmcloud.com/vulnerabilities/48126
debian.org/security/2009/dsa-1715
usn.ubuntu.com/716-1
nvd.nist.gov/vuln/detail/CVE-2009-0260
web.archive.org/web/20200228171520/http://hg.moinmo.in/moin/1.8/rev/8cb4d34ccbc1
github.com/advisories/GHSA-7hjm-hqgj-xv9f
pypi.org/project/moin