{"id":"CVE-2009-0312","aliases":["DSA-1715-1","DTSA-187-1","EUVD-2022-3659","GHSA-cx94-3h5x-cc57","PYSEC-2026-676"],"status":"published","title":"MoinMoin Cross-site scripting (XSS) vulnerability in the antispam feature","description":"Cross-site scripting (XSS) vulnerability in the antispam feature (security/antispam.py) in MoinMoin 1.7 and 1.8.1 allows remote attackers to inject arbitrary web script or HTML via crafted, disallowed content.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02365,"percentile":0.83937,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2009-01-28T00:00:00Z","modified":"2026-07-06T08:11:27Z","fixes":[{"ecosystem":"PyPI","package":"moin","fixed_in":["1.8.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"moin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2"}]}]},{"source":"osv","ecosystem":"Debian:4.0","package":"moin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-1.2etch2"}]}],"versions":["1.5.3-1.2","1.5.3-1.2etch1"],"bundled":2},{"source":"osv","ecosystem":"Debian:5.0","package":"moin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-3+lenny1"}]}],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"moin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"moin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2"}]}]}],"products":[{"vendor":"moinmoin","product":"moinmoin"}],"references":[{"url":"http://hg.moinmo.in/moin/1.8/rev/89b91bf87dad","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/33755","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory","web"]},{"url":"http://hg.moinmo.in/moin/1.7/rev/89b91bf87dad","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/33716","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory","web"]},{"url":"http://osvdb.org/51632","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","web"]},{"url":"http://moinmo.in/SecurityFixes#moin1.8.1","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2009/01/27/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.debian.org/security/2009/dsa-1715","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"https://usn.ubuntu.com/716-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/48306","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-0312","tags":["advisory"]},{"url":"https://usn.ubuntu.com/716-1","tags":["web"]},{"url":"https://web.archive.org/web/20090323075215/http://hg.moinmo.in/moin/1.8/raw-file/1.8.2/docs/CHANGES","tags":["web"]},{"url":"https://web.archive.org/web/20100825000634/http://hg.moinmo.in/moin/1.7/rev/89b91bf87dad","tags":["web"]},{"url":"https://web.archive.org/web/20200228151935/http://hg.moinmo.in/moin/1.8/rev/89b91bf87dad","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cx94-3h5x-cc57","tags":["advisory"]},{"url":"https://pypi.org/project/moin","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2009-0312","description":"Cross-site scripting (XSS) vulnerability in the antispam feature (security/antispam.py) in MoinMoin 1.7 and 1.8.1 allows remote attackers to inject arbitrary web script or HTML via crafted, disallowed content.","status":"published","published":"2009-01-28T01:00:00Z","modified":"2024-08-07T04:31:25.484Z","updated_at":"2026-11-02T14:33:25.516454Z"}],"euvd":[{"id":"EUVD-2022-3659","description":"Cross-site scripting (XSS) vulnerability in the antispam feature (security/antispam.py) in MoinMoin 1.7 and 1.8.1 allows remote attackers to inject arbitrary web script or HTML via crafted, disallowed content.","status":"published","published":"2009-01-28T01:00:00Z","modified":"2024-08-07T04:31:25Z","updated_at":"2026-11-03T01:39:26.059387Z"}],"ghsa":[{"id":"GHSA-cx94-3h5x-cc57","title":"MoinMoin Cross-site scripting (XSS) vulnerability in the antispam feature","description":"Cross-site scripting (XSS) vulnerability in the antispam feature (security/antispam.py) in MoinMoin 1.7 and 1.8.1 allows remote attackers to inject arbitrary web script or HTML via crafted, disallowed content.","status":"published","published":"2022-05-02T03:14:13Z","modified":"2024-05-14T20:41:19Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:48.848211Z"}],"nvd":[{"id":"CVE-2009-0312","description":"Cross-site scripting (XSS) vulnerability in the antispam feature (security/antispam.py) in MoinMoin 1.7 and 1.8.1 allows remote attackers to inject arbitrary web script or HTML via crafted, disallowed content.","status":"published","published":"2009-01-28T01:30:03.17Z","modified":"2026-06-16T23:04:44.387Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:01:33.417327Z"}],"osv":[{"id":"CVE-2009-0312","description":"Cross-site scripting (XSS) vulnerability in the antispam feature (security/antispam.py) in MoinMoin 1.7 and 1.8.1 allows remote attackers to inject arbitrary web script or HTML via crafted, disallowed content.","status":"withdrawn","published":"2009-01-28T01:30:03Z","modified":"2026-07-06T08:11:27.492388707Z","updated_at":"2026-11-02T15:43:57.452479Z"},{"id":"DSA-1715-1","title":"moin - insufficient input sanitising","status":"published","published":"2009-01-29T00:00:00Z","modified":"2026-03-09T01:22:56.215338Z","updated_at":"2026-11-02T15:46:14.734124Z"},{"id":"DTSA-187-1","title":"moin - insufficient input sanitising","status":"published","published":"2009-01-28T00:00:00Z","modified":"2026-03-09T01:01:28.957361Z","updated_at":"2026-11-02T15:46:18.716547Z"},{"id":"GHSA-cx94-3h5x-cc57","title":"MoinMoin Cross-site scripting (XSS) vulnerability in the antispam feature","description":"Cross-site scripting (XSS) vulnerability in the antispam feature (security/antispam.py) in MoinMoin 1.7 and 1.8.1 allows remote attackers to inject arbitrary web script or HTML via crafted, disallowed content.","status":"published","published":"2022-05-02T03:14:13Z","modified":"2026-07-06T08:11:27.492388707Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:45.639885Z"},{"id":"PYSEC-2026-676","title":"MoinMoin Cross-site scripting (XSS) vulnerability in the antispam feature","description":"Cross-site scripting (XSS) vulnerability in the antispam feature (security/antispam.py) in MoinMoin 1.7 and 1.8.1 allows remote attackers to inject arbitrary web script or HTML via crafted, disallowed content.","status":"published","published":"2026-07-02T14:13:21.309699Z","modified":"2026-07-06T08:00:44.790439259Z","updated_at":"2026-11-02T15:52:57.671918Z"}]}}