CVE-2009-0260Medium▾ TwilightPoC availableMoinMoin Multiple cross-site scripting (XSS) vulnerabilities
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 27.5 · likelihood 1.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
5.4%
5.4% → 5.5%
Exploit-DB (last check)
Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin before 1.8.1 allow remote attackers to inject arbitrary web script or HTML via an AttachFile action to the WikiSandBox component with (1) the rename parameter or (2) the drawing parameter (aka the basename variable).
moin < 1.8.1Upgrade to a patched release:
moin 1.8.1Connected by shared product, vendor, weakness, or advisory.
CVE-2009-0312MediumMoinMoin Cross-site scripting (XSS) vulnerability in the antispam feature
CVE-2008-0782MediumMoinMoin Directory traversal vulnerability
CVE-2008-1099MediumMoinMoin Improper Access Control
CVE-2008-1098MediumMoinMoin Multiple cross-site scripting (XSS) vulnerabilities
CVE-2008-0781MediumMoinMoin Multiple cross-site scripting (XSS) vulnerabilities
CVE-2008-0780MediumMoinMoin Cross-site scripting (XSS) vulnerability