Medium severity6.1NVD Advisory· Published Nov 10, 2016· Updated May 6, 2026
CVE-2016-7148
CVE-2016-7148
Description
MoinMoin 1.9.8 allows remote attackers to conduct "JavaScript injection" attacks by using the "page creation" approach, related to a "Cross Site Scripting (XSS)" issue affecting the action=AttachFile (via page name) component.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
moinPyPI | < 1.9.9 | 1.9.9 |
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
11- www.curesec.com/blog/article/blog/MoinMoin-198-XSS-175.htmlnvdExploitThird Party Advisory
- github.com/advisories/GHSA-3x76-j3jj-439jghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2016-7148ghsaADVISORY
- github.com/pypa/advisory-database/tree/main/vulns/moin/PYSEC-2016-31.yamlghsaWEB
- web.archive.org/web/20200227212542/http://www.securityfocus.com/bid/94259ghsaWEB
- web.archive.org/web/20230601130846/https://www.curesec.com/blog/article/blog/MoinMoin-198-XSS-175.htmlghsaWEB
- www.debian.org/security/2016/dsa-3715ghsaWEB
- www.ubuntu.com/usn/USN-3137-1ghsaWEB
- www.debian.org/security/2016/dsa-3715nvd
- www.securityfocus.com/bid/94259nvd
- www.ubuntu.com/usn/USN-3137-1nvd
News mentions
0No linked articles in our index yet.