CVE-2009-0260
MoinMoin Multiple cross-site scripting (XSS) vulnerabilities
CVE-2009-0260 is a medium vulnerability (CVSS 4.3) in Moinmoin, published January 23, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 5.50%, the 92nd percentile. Fixed in moin 1.8.1.
- Severity
- 4.3 MediumCVSS 2.0, NVD
- Exploit chance
- 5.50%EPSS, 92nd percentile
- Exploitation
- None known1 public exploit
- Fixed in
1.8.1moin +2 more
Description
Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin before 1.8.1 allow remote attackers to inject arbitrary web script or HTML via an AttachFile action to the WikiSandBox component with (1) the rename parameter or (2) the drawing parameter (aka the basename variable).
Exploit likelihood
Affected products
Affected packages
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | MoinMoin 1.8 - 'AttachFile.py' Cross-Site Scripting | 2009-01-20 |
What each source reports
NVD Score used
Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin before 1.8.1 allow remote attackers to inject arbitrary web script or HTML via an AttachFile action to the WikiSandBox component with (1) the rename parameter or (2) the drawing parameter (aka the basename variable).
- Record
CVE-2009-0260- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE ListNo score
Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin before 1.8.1 allow remote attackers to inject arbitrary web script or HTML via an AttachFile action to the WikiSandBox component with (1) the rename parameter or (2) the drawing parameter (aka the basename variable).
- Record
CVE-2009-0260- Updated
- 2026-11-02
EUVDEUVD-2022-3012No score
Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin before 1.8.1 allow remote attackers to inject arbitrary web script or HTML via an AttachFile action to the WikiSandBox component with (1) the rename parameter or (2) the drawing parameter (aka the basename variable).
- Record
EUVD-2022-3012- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7hjm-hqgj-xv9fNo score
MoinMoin Multiple cross-site scripting (XSS) vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin before 1.8.1 allow remote attackers to inject arbitrary web script or HTML via an AttachFile action to the WikiSandBox component with (1) the rename parameter or (2) the drawing parameter (aka the basename variable).
- Record
GHSA-7hjm-hqgj-xv9f- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVNo score
Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin before 1.8.1 allow remote attackers to inject arbitrary web script or HTML via an AttachFile action to the WikiSandBox component with (1) the rename parameter or (2) the drawing parameter (aka the basename variable).
- Record
CVE-2009-0260- Updated
- 2026-11-02
OSVGHSA-7hjm-hqgj-xv9fNo score
MoinMoin Multiple cross-site scripting (XSS) vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin before 1.8.1 allow remote attackers to inject arbitrary web script or HTML via an AttachFile action to the WikiSandBox component with (1) the rename parameter or (2) the drawing parameter (aka the basename variable).
- Record
GHSA-7hjm-hqgj-xv9f- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVPYSEC-2026-670No score
MoinMoin Multiple cross-site scripting (XSS) vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin before 1.8.1 allow remote attackers to inject arbitrary web script or HTML via an AttachFile action to the WikiSandBox component with (1) the rename parameter or (2) the drawing parameter (aka the basename variable).
- Record
PYSEC-2026-670- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
secunia.com/advisories/33593
vupen.com/english/advisories/2009/0195
moinmo.in/SecurityFixes
securityfocus.com/bid/33365
Show 10 moreShow less
osvdb.org/51485
hg.moinmo.in/moin/1.8/rev/8cb4d34ccbc1
exchange.xforce.ibmcloud.com/vulnerabilities/48126
debian.org/security/2009/dsa-1715
usn.ubuntu.com/716-1
nvd.nist.gov/vuln/detail/CVE-2009-0260
web.archive.org/web/20200228171520/http://hg.moinmo.in/moin/1.8/rev/8cb4d34ccbc1
github.com/advisories/GHSA-7hjm-hqgj-xv9f
pypi.org/project/moin