{"id":"CVE-2010-2487","aliases":["DEBIAN-CVE-2010-2487","DSA-2083-1","EUVD-2010-0006","GHSA-5m2m-27cg-7v4v","PYSEC-2010-16"],"status":"published","title":"MoinMoin Cross-site Scripting (XSS) vulnerability","description":"Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, 1.8.x before 1.8.8, and 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) Page.py, (2) PageEditor.py, (3) PageGraphicalEditor.py, (4) action/CopyPage.py, (5) action/Load.py, (6) action/RenamePage.py, (7) action/backup.py, (8) action/login.py, (9) action/newaccount.py, and (10) action/recoverpass.py.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02669,"percentile":0.85856,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2010-08-02T00:00:00Z","modified":"2026-06-16T23:20:50Z","fixes":[{"ecosystem":"PyPI","package":"moin","fixed_in":["1.8.8","1.9.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:5.0","package":"moin","fixed_in":["1.7.1-3+lenny5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"moin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.7.3"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"moin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.0"},{"fixed":"1.8.8"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"moin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.0"},{"fixed":"1.9.3"}]}]},{"source":"osv","ecosystem":"Debian:5.0","package":"moin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-3+lenny5"}]}],"versions":["1.7.1-3+lenny1","1.7.1-3+lenny2","1.7.1-3+lenny3","1.7.1-3+lenny4"]},{"source":"osv","ecosystem":"PyPI","package":"moin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.7.3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"moin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.0"},{"fixed":"1.8.8"}]}],"versions":["1.8.4","1.8.5","1.8.6","1.8.7"]},{"source":"osv","ecosystem":"PyPI","package":"moin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.0"},{"fixed":"1.9.3"}]}],"versions":["1.9.0","1.9.1","1.9.2"]},{"source":"osv","ecosystem":"PyPI","package":"moin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8"},{"fixed":"1.8.8"},{"introduced":"1.9"},{"fixed":"1.9.3"}]}],"versions":["1.8.4","1.8.5","1.8.6","1.8.7","1.9.0","1.9.1","1.9.2"]}],"products":[{"vendor":"moinmo","product":"moinmoin"}],"references":[{"url":"http://hg.moinmo.in/moin/1.8/rev/4238b0c90871","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.vupen.com/english/advisories/2010/1981","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Vendor Advisory","advisory"]},{"url":"http://moinmo.in/MoinMoinRelease1.9","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://moinmo.in/SecurityFixes","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"http://www.securityfocus.com/bid/40549","tags":["vdb-entry","x_refsource_BID","x_transferred","Exploit","web"]},{"url":"http://hg.moinmo.in/moin/1.9/rev/68ba3cc79513","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.debian.org/security/2010/dsa-2083","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","web","advisory"]},{"url":"http://hg.moinmo.in/moin/1.9/rev/e50b087c4572","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://moinmo.in/MoinMoinRelease1.8","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://marc.info/?l=oss-security\u0026m=127799369406968\u0026w=2","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://marc.info/?l=oss-security\u0026m=127809682420259\u0026w=2","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://hg.moinmo.in/moin/1.8/raw-file/1.8.8/docs/CHANGES","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://hg.moinmo.in/moin/1.7/rev/37306fba2189","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/40836","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-2487","tags":["advisory"]},{"url":"https://web.archive.org/web/20140801154518/http://secunia.com/advisories/40836","tags":["web"]},{"url":"https://web.archive.org/web/20200228150629/http://www.securityfocus.com/bid/40549","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/moin/PYSEC-2010-16.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5m2m-27cg-7v4v","tags":["advisory"]},{"url":"https://github.com/moinwiki/moin","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2010-2487","description":"Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, 1.8.x before 1.8.8, and 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) Page.py, (2) PageEditor.py, (3) PageGraphicalEditor.py, (4) action/CopyPage.py, (5) action/Load.py, (6) action/RenamePage.py, (7) action/backup.py, (8) action/login.py, (9) action/newaccount.py, and (10) action/recoverpass.py.","status":"published","published":"2010-08-04T21:00:00Z","modified":"2024-08-07T02:32:16.844Z","updated_at":"2026-11-02T14:33:27.01833Z"}],"euvd":[{"id":"EUVD-2010-0006","description":"Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, 1.8.x before 1.8.8, and 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) Page.py, (2) PageEditor.py, (3) PageGraphicalEditor.py, (4) action/CopyPage.py, (5) action/Load.py, (6) action/RenamePage.py, (7) action/backup.py, (8) action/login.py, (9) action/newaccount.py, and (10) action/recoverpass.py.","status":"published","published":"2010-08-04T21:00:00Z","modified":"2024-08-07T02:32:16Z","updated_at":"2026-11-03T01:39:37.858649Z"}],"ghsa":[{"id":"GHSA-5m2m-27cg-7v4v","title":"MoinMoin Cross-site Scripting (XSS) vulnerability","description":"Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, 1.8.x before 1.8.8, and 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) `Page.py`, (2) `PageEditor.py`, (3) `PageGraphicalEditor.py`, (4) `action/CopyPage.py`, (5) `action/Load.py`, (6) `action/RenamePage.py`, (7) `action/backup.py`, (8) `action/login.py`, (9) `action/newaccount.py`, and (10) `action/recoverpass.py`.","status":"published","published":"2022-05-17T05:49:23Z","modified":"2024-09-26T14:50:05Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:06.29677Z"}],"nvd":[{"id":"CVE-2010-2487","description":"Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, 1.8.x before 1.8.8, and 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) Page.py, (2) PageEditor.py, (3) PageGraphicalEditor.py, (4) action/CopyPage.py, (5) action/Load.py, (6) action/RenamePage.py, (7) action/backup.py, (8) action/login.py, (9) action/newaccount.py, and (10) action/recoverpass.py.","status":"published","published":"2010-08-05T13:22:28.857Z","modified":"2026-06-16T23:20:50.683Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:01:49.736647Z"}],"osv":[{"id":"GHSA-5m2m-27cg-7v4v","title":"MoinMoin Cross-site Scripting (XSS) vulnerability","description":"Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, 1.8.x before 1.8.8, and 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) `Page.py`, (2) `PageEditor.py`, (3) `PageGraphicalEditor.py`, (4) `action/CopyPage.py`, (5) `action/Load.py`, (6) `action/RenamePage.py`, (7) `action/backup.py`, (8) `action/login.py`, (9) `action/newaccount.py`, and (10) `action/recoverpass.py`.","status":"published","published":"2022-05-17T05:49:23Z","modified":"2024-09-26T15:12:03.232896Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:38.553953Z"},{"id":"DSA-2083-1","title":"moin - cross-site scripting","status":"published","published":"2010-08-02T00:00:00Z","modified":"2026-03-09T01:19:14.444784Z","updated_at":"2026-11-02T15:46:15.108335Z"},{"id":"PYSEC-2010-16","description":"Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, 1.8.x before 1.8.8, and 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) Page.py, (2) PageEditor.py, (3) PageGraphicalEditor.py, (4) action/CopyPage.py, (5) action/Load.py, (6) action/RenamePage.py, (7) action/backup.py, (8) action/login.py, (9) action/newaccount.py, and (10) action/recoverpass.py.","status":"published","published":"2010-08-05T13:22:00Z","modified":"2026-06-10T17:02:22.071849972Z","updated_at":"2026-11-02T15:52:51.254177Z"}]}}