GCVE - cpe:2.3:a:moinmo:moinmoin:1.9.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:moinmo:moinmoin:1.9.0:*:*:*:*:*:*:*

part: a version: 1.9.0 update: *

Vendor	Moinmo (`58c70b4d-cd8a-507b-9233-feb4a4950633`)
Product	Moinmoin (`f3d95b03-b7c6-513e-b92d-927b96b7f8a5`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/python-moinmoin`	purl2cpe	2026-06-01 10:13:26.276117
`pkg:deb/ubuntu/python-moinmoin`	purl2cpe	2026-06-01 10:13:26.276118
`pkg:github/moinwiki/moin`	purl2cpe	2026-06-01 10:13:26.276119
`pkg:github/moinwiki/moin-1.9`	purl2cpe	2026-06-01 10:13:26.276121
`pkg:pypi/moin`	purl2cpe	2026-06-01 10:13:26.276122
`pkg:rpm/opensuse/python-moin`	purl2cpe	2026-06-01 10:13:26.276124

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2012-6495`	vulnerable	2026-06-08 05:03:00.500697	Details available Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to overwrite arbitrary files via unspecified vectors. NOTE: this can be leveraged with CVE-2012-6081 to execute arbitrary code. Published: 2013-01-03T01:00:00.000Z Updated: 2024-09-16T23:26:18.200Z Open on db.gcve.eu Reference links http://moinmo.in/MoinMoinRelease1.9 http://moinmo.in/SecurityFixes http://hg.moinmo.in/moin/1.9/rev/7e7e1cbb9d3f http://www.debian.org/security/2012/dsa-2593 https://bugs.launchpad.net/ubuntu/+source/moin/+bug/1094599	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-6081`	vulnerable	2026-06-08 05:02:59.260987	Details available Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory, as exploited in the wild in July 2012. Published: 2013-01-03T01:00:00.000Z Updated: 2024-08-06T21:21:28.522Z Open on db.gcve.eu Reference links http://moinmo.in/MoinMoinRelease1.9 http://moinmo.in/SecurityFixes http://secunia.com/advisories/51663 http://hg.moinmo.in/moin/1.9/rev/7e7e1cbb9d3f http://www.debian.org/security/2012/dsa-2593	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-4404`	vulnerable	2026-06-08 05:02:17.302131	Details available security/__init__.py in MoinMoin 1.9 through 1.9.4 does not properly handle group names that contain virtual group names such as "All," "Known," or "Trusted," which allows remote authenticated users with virtual group membership to be treated as a member of the group. Published: 2012-09-10T22:00:00.000Z Updated: 2024-08-06T20:35:09.512Z Open on db.gcve.eu Reference links http://www.ubuntu.com/usn/USN-1604-1 http://secunia.com/advisories/50496 http://moinmo.in/SecurityFixes http://www.debian.org/security/2012/dsa-2538 http://www.openwall.com/lists/oss-security/2012/09/04/4	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-1058`	vulnerable	2026-06-08 04:56:41.043966	Details available Cross-site scripting (XSS) vulnerability in the reStructuredText (rst) parser in parser/text_rst.py in MoinMoin before 1.9.3, when docutils is installed or when "format rst" is set, allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in the refuri attribute. NOTE: some of these details are obtained from third party information. Published: 2011-02-22T17:00:00.000Z Updated: 2024-08-06T22:14:27.368Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/46476 http://www.ubuntu.com/usn/USN-1604-1 http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055116.html http://moinmo.in/SecurityFixes http://www.debian.org/security/2011/dsa-2321	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-2970`	vulnerable	2026-06-08 04:55:11.870399	Details available Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) action/SlideShow.py, (2) action/anywikidraw.py, and (3) action/language_setup.py, a similar issue to CVE-2010-2487. Published: 2010-08-04T21:00:00.000Z Updated: 2024-09-17T00:16:31.838Z Open on db.gcve.eu Reference links http://www.vupen.com/english/advisories/2010/1981 http://moinmo.in/MoinMoinRelease1.9 http://moinmo.in/SecurityFixes http://www.securityfocus.com/bid/40549 http://hg.moinmo.in/moin/1.9/rev/4fe9951788cb	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-2969`	vulnerable	2026-06-08 04:55:11.869897	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-2487`	vulnerable	2026-06-08 04:55:08.160680	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-0669`	vulnerable	2026-06-08 04:52:03.894942	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-0668`	vulnerable	2026-06-08 04:52:03.891950	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-0667`	vulnerable	2026-06-08 04:52:03.869611	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

moinmo MoinMoin 1.9.0

Notes

PURL mappings

Vulnerability references

Contribute