Medium severity6.1NVD Advisory· Published Nov 10, 2016· Updated May 6, 2026
CVE-2016-7146
CVE-2016-7146
Description
MoinMoin 1.9.8 allows remote attackers to conduct "JavaScript injection" attacks by using the "page creation or crafted URL" approach, related to a "Cross Site Scripting (XSS)" issue affecting the action=fckdialog&dialog=attachment (via page name) component.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
moinPyPI | >= 1.9.8, < 1.9.9 | 1.9.9 |
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
9- www.curesec.com/blog/article/blog/MoinMoin-198-XSS-175.htmlnvdExploitThird Party Advisory
- github.com/advisories/GHSA-fj26-q4vh-85f6ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2016-7146ghsaADVISORY
- www.debian.org/security/2016/dsa-3715nvdWEB
- www.ubuntu.com/usn/USN-3137-1nvdWEB
- github.com/pypa/advisory-database/tree/main/vulns/moin/PYSEC-2016-30.yamlghsaWEB
- web.archive.org/web/20200227212542/http://www.securityfocus.com/bid/94259ghsaWEB
- web.archive.org/web/20200426045730/https://www.curesec.com/blog/article/blog/MoinMoin-198-XSS-175.htmlghsaWEB
- www.securityfocus.com/bid/94259nvd
News mentions
0No linked articles in our index yet.