MoinMoin Cross-site Scripting (XSS) vulnerability

中危 6.1CVE-2016-7148 · GHSA-3x76-j3jj-439j · PYSEC-2016-31 · Published 10/11/2016 · updated 17/06/2026

Package	Affected versions	Patched versions
moin PyPI	`< 1.9.9`	`1.9.9`
moinmoin moinmo	`= 1.9.8`	No fix yet

Description

MoinMoin 1.9.8 allows remote attackers to conduct "JavaScript injection" attacks by using the "page creation" approach, related to a "Cross Site Scripting (XSS)" issue affecting the action=AttachFile (via page name) component.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2016-7148 · ADVISORY
moinwiki/moin · PACKAGE
pypa/advisory-database · WEB
web.archive.org/web/20200227212542/http://www.securityfocus.com/bid/94259 · WEB
web.archive.org/web/20230601130846/https://www.curesec.com/blog/article/blog/MoinMoin-198-XSS-175.html · WEB
debian.org/security/2016/dsa-3715 · WEB
ubuntu.com/usn/USN-3137-1 · WEB
debian.org/security/2016/dsa-3715
securityfocus.com/bid/94259
ubuntu.com/usn/USN-3137-1
curesec.com/blog/article/blog/MoinMoin-198-XSS-175.html · Exploit
GitHub Advisory GHSA-3x76-j3jj-439j · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free