CVE-2009-0260

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-01-23 · updated 2026-06-16
Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin before 1.8.1 allow remote attackers to inject arbitrary web script or HTML via an AttachFile action to the WikiSandBox component with (1) the rename parameter or (2) the drawing parameter (aka the basename variable).

Affected products

Moinmoin: through 1.8.0; 0.1, 0.2, 0.3, 0.7, 0.8, 0.9 (+29)

References

http://hg.moinmo.in/moin/1.8/rev/8cb4d34ccbc1
http://moinmo.in/SecurityFixes#moin1.8.1
http://osvdb.org/51485
http://secunia.com/advisories/33593
http://secunia.com/advisories/33716
http://secunia.com/advisories/33755
http://www.securityfocus.com/archive/1/500197/100/0/threaded
http://www.securityfocus.com/bid/33365
http://www.vupen.com/english/advisories/2009/0195
https://exchange.xforce.ibmcloud.com/vulnerabilities/48126
https://usn.ubuntu.com/716-1/
https://www.debian.org/security/2009/dsa-1715

Get alerted when CVE-2009-0260 or the next vulnerability affects your stack