MoinMoin Multiple cross-site scripting (XSS) vulnerabilities

Also known as GHSA-775g-4482-pm94, PYSEC-2026-669

Published 18 y ago 2008-02-14 · modified 4 mo ago 2026-07-06 · JSON

CVSS

4.3

v2.0 · NVD

CISA KEV

not known exploited

EPSS

2.6%

percentile 85%

Public exploits

none known

Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin 1.5.8 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) message, (2) pagename, and (3) target filenames.

Exploit prediction (EPSS)

2.56% probability of exploitation in the next 30 days, higher than 85% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:N/I:P/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
pypi	`moin`	<=1.5.8	no fix listed

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

secunia.com /advisories/33755 · third-party-advisory, x_refsource_SECUNIA, x_transferred
gentoo.org /security/en/glsa/glsa-200803-27.xml · vendor-advisory, x_refsource_GENTOO, x_transferred
secunia.com /advisories/29262 · third-party-advisory, x_refsource_SECUNIA, x_transferred
secunia.com /advisories/29010 · third-party-advisory, x_refsource_SECUNIA, x_transferred
redhat.com /archives/fedora-package-announce/2008-February/msg00726.html · vendor-advisory, x_refsource_FEDORA, x_transferred
secunia.com /advisories/28987 · third-party-advisory, x_refsource_SECUNIA, x_transferred
vupen.com /english/advisories/2008/0569/references · vdb-entry, x_refsource_VUPEN, x_transferred
securityfocus.com /bid/27904 · vdb-entry, x_refsource_BID, x_transferred
bugzilla.redhat.com /show_bug.cgi?id=432748 · x_refsource_CONFIRM, x_transferred
secunia.com /advisories/29444 · third-party-advisory, x_refsource_SECUNIA, x_transferred
redhat.com /archives/fedora-package-announce/2008-February/msg00752.html · vendor-advisory, x_refsource_FEDORA, x_transferred
hg.moinmo.in /moin/1.5/rev/db212dfc58ef · x_refsource_CONFIRM, x_transferred
usn.ubuntu.com /716-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
debian.org /security/2008/dsa-1514 · vendor-advisory, x_refsource_DEBIAN, x_transferred
nvd.nist.gov /vuln/detail/CVE-2008-0781 · advisory
usn.ubuntu.com /716-1 · web
pypi.org /project/moin · package
github.com /advisories/GHSA-775g-4482-pm94 · advisory

Sources

CVE List: CVE-2008-0781
GitHub Advisory: GHSA-775g-4482-pm94
NVD: CVE-2008-0781
OSV: PYSEC-2026-669

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.