# moin (PyPI) vulnerabilities 41 known vulnerabilities (1 high), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 1.9.11 (Nov 8, 2020): affected by CVE-2008-6548 - Newest unaffected release: Every release is affected by at least one advisory - Weekly downloads: 78 - Dependents: 1 - Releases: 22 since 1.8.4 (Oct 5, 2015) - Registry: https://pypi.org/project/moin/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2020-15275: 1.8.4 to 1.9.10 (1.9.11 is outside it) - CVE-2020-25074: 1.8.4 to 1.9.10 (1.9.11 is outside it) - CVE-2017-5934: 1.8.4 to 1.9.9 (1.9.10 is outside it) - CVE-2016-9119: 1.8.4 to 1.9.7 (1.9.8 is outside it) - CVE-2016-7148: 1.8.4 to 1.9.8 (1.9.9 is outside it) - CVE-2016-7146: 1.8.4 to 1.9.8 (1.9.9 is outside it) - CVE-2012-6495: 1.8.4 to 1.9.5 (1.9.6 is outside it) - CVE-2012-6082: 1.8.4 to 1.9.5 (1.9.6 is outside it) - CVE-2012-6081: 1.8.4 to 1.9.5 (1.9.6 is outside it) - CVE-2012-6080: 1.9.3 to 1.9.5 (1.9.6 is outside it) - CVE-2012-4404: 1.9.0 to 1.9.4 (1.9.5 is outside it) - CVE-2011-1058: 1.8.4 to 1.9.2 (1.9.3 is outside it) - CVE-2010-2970: 1.9.0 to 1.9.2 (1.9.3 is outside it) - CVE-2010-2969: 1.9.0 to 1.9.2 (1.9.3 is outside it) - CVE-2010-2487: 1.8.4 to 1.9.2 (1.9.3 is outside it) - CVE-2010-0828: 1.8.4 to 1.9.2 (1.9.3 is outside it) - CVE-2009-4762: no published release is affected - CVE-2010-0717: 1.8.4 to 1.8.6 (1.8.7 is outside it) - CVE-2010-0669: 1.8.4 to 1.8.6 (1.8.7 is outside it); 1.9.0 to 1.9.1 (1.9.2 is outside it) - CVE-2010-0668: 1.8.4 to 1.8.6 (1.8.7 is outside it); 1.9.0 to 1.9.1 (1.9.2 is outside it) - CVE-2010-0667: 1.9.0 (1.9.1 is outside it) - CVE-2009-1482: no published release is affected - CVE-2008-6603: no published release is affected - CVE-2008-6549: no published release is affected - CVE-2008-6548: 1.8.4 to 2.0.0b5 (through the newest release) - CVE-2009-0312: no published release is affected - CVE-2009-0260: no published release is affected - CVE-2008-3381: no published release is affected - CVE-2008-1937: no published release is affected - CVE-2008-1099: no published release is affected - CVE-2008-1098: no published release is affected - CVE-2008-0782: no published release is affected - CVE-2008-0781: no published release is affected - CVE-2008-0780: no published release is affected - CVE-2007-2637: no published release is affected - CVE-2007-0902: no published release is affected - CVE-2007-0901: no published release is affected - CVE-2007-0857: no published release is affected - CVE-2004-1463: no published release is affected - CVE-2004-1462: no published release is affected - CVE-2004-0708: no published release is affected ## Advisories (41) ### [CVE-2020-15275](https://cve.now/CVE-2020-15275): malicious SVG attachment causing stored XSS vulnerability in MoinMoin - Severity: High 8.7 - Published: Nov 11, 2020 - Affected: fixed in 1.9.11. - Fixed in 1.9.11 (released Nov 8, 2020, 3 days before disclosure). - The latest release, 1.9.11, is not affected. ### [CVE-2020-25074](https://cve.now/CVE-2020-25074): The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. - Severity: Unrated - Published: Nov 10, 2020 - Affected: fixed in 1.9.11; fixed in 1.9.11. - Fixed in 1.9.11 (released Nov 8, 2020, 2 days before disclosure). - The latest release, 1.9.11, is not affected. ### [CVE-2017-5934](https://cve.now/CVE-2017-5934): Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.10 allows remote attackers to inject… - Severity: Unrated - Published: Oct 15, 2018 - Affected: fixed in 1.9.10. - Fixed in 1.9.10 (released Sep 9, 2018, 36 days before disclosure). - The latest release, 1.9.11, is not affected. ### [CVE-2016-9119](https://cve.now/CVE-2016-9119): Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.8 allows remote attackers to inject… - Severity: Unrated - Published: Jan 30, 2017 - Affected: fixed in 1.9.8. - Fixed in 1.9.8 (released Oct 17, 2014, 836 days before disclosure). - The latest release, 1.9.11, is not affected. ### [CVE-2016-7148](https://cve.now/CVE-2016-7148): MoinMoin 1.9.8 allows remote attackers to conduct "JavaScript injection" attacks by using the "page creation" approach, related to a… - Severity: Unrated - Published: Nov 10, 2016 - Affected: fixed in 1.9.9. - Fixed in 1.9.9 (released Oct 31, 2016, 10 days before disclosure). - The latest release, 1.9.11, is not affected. ### [CVE-2016-7146](https://cve.now/CVE-2016-7146): MoinMoin 1.9.8 allows remote attackers to conduct "JavaScript injection" attacks by using the "page creation or crafted URL" approach… - Severity: Unrated - Published: Nov 10, 2016 - Affected: from 1.9.8, fixed in 1.9.9; fixed in 1.9.9. - Fixed in 1.9.9 (released Oct 31, 2016, 10 days before disclosure). - The latest release, 1.9.11, is not affected. ### [CVE-2012-6495](https://cve.now/CVE-2012-6495): Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py)… - Severity: Unrated - Published: Jan 3, 2013 - Affected: fixed in 1.9.6. - Fixed in 1.9.6 (released Oct 5, 2015, 1005 days after disclosure). - The latest release, 1.9.11, is not affected. ### [CVE-2012-6082](https://cve.now/CVE-2012-6082): Cross-site scripting (XSS) vulnerability in the rsslink function in theme/init.py in MoinMoin 1.9.5 allows remote attackers to inject… - Severity: Unrated - Published: Jan 3, 2013 - Affected: fixed in 1.9.6. - Fixed in 1.9.6 (released Oct 5, 2015, 1005 days after disclosure). - The latest release, 1.9.11, is not affected. ### [CVE-2012-6081](https://cve.now/CVE-2012-6081): Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py)… - Severity: Unrated - Published: Jan 3, 2013 - Affected: fixed in 1.9.6. - Fixed in 1.9.6 (released Oct 5, 2015, 1005 days after disclosure). - The latest release, 1.9.11, is not affected. ### [CVE-2012-6080](https://cve.now/CVE-2012-6080): Directory traversal vulnerability in the \_do\_attachment\_move function in the AttachFile action (action/AttachFile.py) in MoinMoin 1.9.3… - Severity: Unrated - Published: Jan 3, 2013 - Affected: from 1.9.3, fixed in 1.9.6. - Fixed in 1.9.6 (released Oct 5, 2015, 1005 days after disclosure). - The latest release, 1.9.11, is not affected. ### [CVE-2012-4404](https://cve.now/CVE-2012-4404): security/init.py in MoinMoin 1.9 through 1.9.4 does not properly handle group names that contain virtual group names such as "All,"… - Severity: Unrated - Published: Sep 10, 2012 - Affected: from 1.9, fixed in 1.9.5. - Fixed in 1.9.5 (released Oct 5, 2015, 1120 days after disclosure). - The latest release, 1.9.11, is not affected. ### [CVE-2011-1058](https://cve.now/CVE-2011-1058): Cross-site scripting (XSS) vulnerability in the reStructuredText (rst) parser in parser/text\_rst.py in MoinMoin before 1.9.3, when… - Severity: Unrated - Published: Feb 22, 2011 - Affected: fixed in 1.9.3. - Fixed in 1.9.3 (released Oct 5, 2015, 1686 days after disclosure). - The latest release, 1.9.11, is not affected. ### [CVE-2010-2970](https://cve.now/CVE-2010-2970): Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script… - Severity: Unrated - Published: Aug 4, 2010 - Affected: from 1.9, fixed in 1.9.3; from 1.9.0, fixed in 1.9.3. - Fixed in 1.9.3 (released Oct 5, 2015, 1888 days after disclosure). - The latest release, 1.9.11, is not affected. ### [CVE-2010-2969](https://cve.now/CVE-2010-2969): Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, and 1.9.x before 1.9.3, allow remote attackers to… - Severity: Unrated - Published: Aug 4, 2010 - Affected: through 1.7.3; from 1.9.0, fixed in 1.9.3; from 1.9, fixed in 1.9.3. - Fixed in 1.9.3 (released Oct 5, 2015, 1888 days after disclosure). - The latest release, 1.9.11, is not affected. ### [CVE-2010-2487](https://cve.now/CVE-2010-2487): Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, 1.8.x before 1.8.8, and 1.9.x before 1.9.3 allow remote… - Severity: Unrated - Published: Aug 4, 2010 - Affected: through 1.7.3; from 1.8.0, fixed in 1.8.8; from 1.9.0, fixed in 1.9.3; from 1.8, fixed in 1.8.8; from 1.9, fixed in 1.9.3. - Fixed in 1.9.3 (released Oct 5, 2015, 1888 days after disclosure, the advisory names 1.8.8, which was never published). - The latest release, 1.9.11, is not affected. ### [CVE-2010-0828](https://cve.now/CVE-2010-0828): Cross-site scripting (XSS) vulnerability in action/Despam.py in the Despam action module in MoinMoin 1.8.7 and 1.9.2 allows remote… - Severity: Unrated - Published: Apr 5, 2010 - Affected: fixed in 1.9.3; from 1.9.0, fixed in 1.9.3; from 1.8.0, fixed in 1.8.8. - Fixed in 1.9.3 (released Oct 5, 2015, 2009 days after disclosure). - The latest release, 1.9.11, is not affected. ### [CVE-2009-4762](https://cve.now/CVE-2009-4762): MoinMoin 1.7.x before 1.7.3 and 1.8.x before 1.8.3 checks parent ACLs in certain inappropriate circumstances during processing of… - Severity: Unrated - Published: Mar 29, 2010 - Affected: from 1.7.0, fixed in 1.7.3; from 1.8.0, fixed in 1.8.3; from 1.7, fixed in 1.7.3; from 1.8, fixed in 1.8.3. - Fixed in 1.8.4 (released Oct 5, 2015, 2016 days after disclosure, the advisory names 1.7.3, which was never published). - The latest release, 1.9.11, is not affected. ### [CVE-2010-0717](https://cve.now/CVE-2010-0717): The default configuration of cfg.packagepages\_actions\_excluded in MoinMoin before 1.8.7 does not prevent unsafe package actions, which has… - Severity: Unrated - Published: Feb 26, 2010 - Affected: fixed in 1.8.7. - Fixed in 1.8.7 (released Oct 5, 2015, 2047 days after disclosure). - The latest release, 1.9.11, is not affected. ### [CVE-2010-0669](https://cve.now/CVE-2010-0669): MoinMoin before 1.8.7 and 1.9.x before 1.9.2 does not properly sanitize user profiles, which has unspecified impact and attack vectors. - Severity: Unrated - Published: Feb 26, 2010 - Affected: fixed in 1.8.7; from 1.9, fixed in 1.9.2; fixed in 1.8.7; from 1.9, fixed in 1.9.2. - Fixed in 1.8.7 (released Oct 5, 2015, 2047 days after disclosure) and 1.9.2 (released Oct 5, 2015, 2047 days after disclosure). - The latest release, 1.9.11, is not affected. ### [CVE-2010-0668](https://cve.now/CVE-2010-0668): Unspecified vulnerability in MoinMoin 1.5.x through 1.7.x, 1.8.x before 1.8.7, and 1.9.x before 1.9.2 has unknown impact and attack… - Severity: Unrated - Published: Feb 26, 2010 - Affected: from 1.5, fixed in 1.8.7; from 1.9, fixed in 1.9.2; from 1.8, fixed in 1.8.7; from 1.9, fixed in 1.9.2. - Fixed in 1.8.7 (released Oct 5, 2015, 2047 days after disclosure) and 1.9.2 (released Oct 5, 2015, 2047 days after disclosure). - The latest release, 1.9.11, is not affected. ### [CVE-2010-0667](https://cve.now/CVE-2010-0667): MoinMoin 1.9 before 1.9.1 does not perform the expected clearing of the sys.argv array in situations where the GATEWAY\_INTERFACE… - Severity: Unrated - Published: Feb 26, 2010 - Affected: from 1.9, fixed in 1.9.1. - Fixed in 1.9.1 (released Oct 5, 2015, 2047 days after disclosure). - The latest release, 1.9.11, is not affected. ### [CVE-2009-1482](https://cve.now/CVE-2009-1482): Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin 1.8.2 and earlier allow remote attackers to inject… - Severity: Unrated - Published: Apr 29, 2009 - Affected: fixed in 1.8.3. - Fixed in 1.8.4 (released Oct 5, 2015, 2350 days after disclosure, the advisory names 1.8.3, which was never published). - The latest release, 1.9.11, is not affected. ### [CVE-2008-6603](https://cve.now/CVE-2008-6603): MoinMoin 1.6.2 and 1.7 does not properly enforce ACL checks when acl\_hierarchic is set to True, which might allow remote attackers to… - Severity: Unrated - Published: Apr 3, 2009 - Affected: fixed in 1.6.3; from 1.7, fixed in 1.7.1; fixed in 1.6.3; from 1.7, fixed in 1.7.1. - Fixed in 1.8.4 (released Oct 5, 2015, 2376 days after disclosure, the advisory names 1.6.3, which was never published). - The latest release, 1.9.11, is not affected. ### [CVE-2008-6549](https://cve.now/CVE-2008-6549): The password\_checker function in config/multiconfig.py in MoinMoin 1.6.1 uses the cracklib and python-crack features even though they are… - Severity: Unrated - Published: Mar 30, 2009 - Affected: fixed in 1.6.1. - Fixed in 1.8.4 (released Oct 5, 2015, 2380 days after disclosure, the advisory names 1.6.1, which was never published). - The latest release, 1.9.11, is not affected. ### [CVE-2008-6548](https://cve.now/CVE-2008-6548): The rst parser (parser/text\_rst.py) in MoinMoin 1.6.1 does not check the ACL of an included page, which allows attackers to read… - Severity: Unrated - Published: Mar 30, 2009 - Affected: all versions; fixed in 1.6.2. - No fix released. The latest release, 1.9.11, is still affected. ### [CVE-2009-0312](https://cve.now/CVE-2009-0312): Cross-site scripting (XSS) vulnerability in the antispam feature (security/antispam.py) in MoinMoin 1.7 and 1.8.1 allows remote attackers… - Severity: Unrated - Published: Jan 28, 2009 - Affected: fixed in 1.8.2. - Fixed in 1.8.4 (released Oct 5, 2015, 2441 days after disclosure, the advisory names 1.8.2, which was never published). - The latest release, 1.9.11, is not affected. ### [CVE-2009-0260](https://cve.now/CVE-2009-0260): Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin before 1.8.1 allow remote attackers to inject… - Severity: Unrated - Published: Jan 23, 2009 - Affected: fixed in 1.8.1. - Fixed in 1.8.4 (released Oct 5, 2015, 2446 days after disclosure, the advisory names 1.8.1, which was never published). - The latest release, 1.9.11, is not affected. ### [CVE-2008-3381](https://cve.now/CVE-2008-3381): Multiple cross-site scripting (XSS) vulnerabilities in macro/AdvancedSearch.py in moin (and MoinMoin) 1.6.3 and 1.7.0 allow remote… - Severity: Unrated - Published: Jul 30, 2008 - Affected: fixed in 1.6.4; from 1.7.0, fixed in 1.7.1; fixed in 1.6.4; from 1.7.0, fixed in 1.7.1. - Fixed in 1.8.4 (released Oct 5, 2015, 2623 days after disclosure, the advisory names 1.6.4, which was never published). - The latest release, 1.9.11, is not affected. ### [CVE-2008-1937](https://cve.now/CVE-2008-1937): The user form processing (userform.py) in MoinMoin before 1.6.3, when using ACLs or a non-empty superusers list, does not properly manage… - Severity: Unrated - Published: Apr 24, 2008 - Affected: fixed in 1.6.3; from 1.7, fixed in 1.7.1; fixed in 1.6.3. - Fixed in 1.8.4 (released Oct 5, 2015, 2720 days after disclosure, the advisory names 1.6.3, which was never published). - The latest release, 1.9.11, is not affected. ### [CVE-2008-1099](https://cve.now/CVE-2008-1099): \_macro\_Getval in wikimacro.py in MoinMoin 1.5.8 and earlier does not properly enforce ACLs, which allows remote attackers to read… - Severity: Unrated - Published: Mar 5, 2008 - Affected: through 1.5.8. - Fixed in 1.8.4 (released Oct 5, 2015, 2770 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 1.9.11, is not affected. ### [CVE-2008-1098](https://cve.now/CVE-2008-1098): Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.5.8 and earlier allow remote attackers to inject arbitrary web script or… - Severity: Unrated - Published: Mar 5, 2008 - Affected: through 1.5.8. - Fixed in 1.8.4 (released Oct 5, 2015, 2770 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 1.9.11, is not affected. ### [CVE-2008-0782](https://cve.now/CVE-2008-0782): Directory traversal vulnerability in MoinMoin 1.5.8 and earlier allows remote attackers to overwrite arbitrary files via a .. - Severity: Unrated - Published: Feb 14, 2008 - Affected: through 1.5.8. - Fixed in 1.8.4 (released Oct 5, 2015, 2790 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 1.9.11, is not affected. ### [CVE-2008-0781](https://cve.now/CVE-2008-0781): Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin 1.5.8 and earlier allow remote attackers to inject… - Severity: Unrated - Published: Feb 14, 2008 - Affected: through 1.5.8. - Fixed in 1.8.4 (released Oct 5, 2015, 2790 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 1.9.11, is not affected. ### [CVE-2008-0780](https://cve.now/CVE-2008-0780): Cross-site scripting (XSS) vulnerability in MoinMoin 1.5.x through 1.5.8 and 1.6.x before 1.6.1 allows remote attackers to inject… - Severity: Unrated - Published: Feb 14, 2008 - Affected: from 1.5, through 1.5.8; from 1.6, fixed in 1.6.1; from 1.5, fixed in 1.6.1. - Fixed in 1.8.4 (released Oct 5, 2015, 2790 days after disclosure, the advisory names 1.6.1, which was never published). - The latest release, 1.9.11, is not affected. ### [CVE-2007-2637](https://cve.now/CVE-2007-2637): MoinMoin before 20070507 does not properly enforce ACLs for calendars and includes, which allows remote attackers to read certain pages… - Severity: Unrated - Published: May 13, 2007 - Affected: fixed in 1.5.8. - Fixed in 1.8.4 (released Oct 5, 2015, 3067 days after disclosure, the advisory names 1.5.8, which was never published). - The latest release, 1.9.11, is not affected. ### [CVE-2007-0902](https://cve.now/CVE-2007-0902): Unspecified vulnerability in the "Show debugging information" feature in MoinMoin 1.5.7 allows remote attackers to obtain sensitive… - Severity: Unrated - Published: Feb 13, 2007 - Affected: from 1.5.7, fixed in 1.5.8. - Fixed in 1.8.4 (released Oct 5, 2015, 3156 days after disclosure, the advisory names 1.5.8, which was never published). - The latest release, 1.9.11, is not affected. ### [CVE-2007-0901](https://cve.now/CVE-2007-0901): Multiple cross-site scripting (XSS) vulnerabilities in Info pages in MoinMoin 1.5.7 allow remote attackers to inject arbitrary web script… - Severity: Unrated - Published: Feb 13, 2007 - Affected: fixed in 1.5.8. - Fixed in 1.8.4 (released Oct 5, 2015, 3156 days after disclosure, the advisory names 1.5.8, which was never published). - The latest release, 1.9.11, is not affected. ### [CVE-2007-0857](https://cve.now/CVE-2007-0857): Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin before 1.5.7 allow remote attackers to inject arbitrary web script or HTML… - Severity: Unrated - Published: Feb 8, 2007 - Affected: fixed in 1.5.7. - Fixed in 1.8.4 (released Oct 5, 2015, 3161 days after disclosure, the advisory names 1.5.7, which was never published). - The latest release, 1.9.11, is not affected. ### [CVE-2004-1463](https://cve.now/CVE-2004-1463): Unknown vulnerability in the PageEditor in MoinMoin 1.2.2 and earlier, related to Access Control Lists (ACL), has unknown impact. - Severity: Unrated - Published: Feb 13, 2005 - Affected: fixed in 1.2.3. - Fixed in 1.8.4 (released Oct 5, 2015, 3886 days after disclosure, the advisory names 1.2.3, which was never published). - The latest release, 1.9.11, is not affected. ### [CVE-2004-1462](https://cve.now/CVE-2004-1462): Unknown vulnerability in MoinMoin 1.2.2 and earlier allows remote attackers to gain unauthorized access to administrator functions such as… - Severity: Unrated - Published: Feb 13, 2005 - Affected: fixed in 1.2.3. - Fixed in 1.8.4 (released Oct 5, 2015, 3886 days after disclosure, the advisory names 1.2.3, which was never published). - The latest release, 1.9.11, is not affected. ### [CVE-2004-0708](https://cve.now/CVE-2004-0708): MoinMoin 1.2.1 and earlier allows remote attackers to gain privileges by creating a user with the same name as an existing group that has… - Severity: Unrated - Published: Jul 21, 2004 - Affected: fixed in 1.2.2. - Fixed in 1.8.4 (released Oct 5, 2015, 4093 days after disclosure, the advisory names 1.2.2, which was never published). - The latest release, 1.9.11, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/moin Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.