CVE-2020-15275

MoinMoin is a wiki engine. In MoinMoin before version 1.9.11, an attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user's browser when the user is viewing that SVG file on the wiki. Users are strongly advised to upgrade to a patched version. MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.

• CWE-79

• https://advisory.checkmarx.net/advisory/CX-2020-4285Exploit, Third Party Advisory
• https://github.com/moinwiki/moin-1.9/commit/31de9139d0aabc171e94032168399b4a0b2a88a2Patch, Third Party Advisory
• https://github.com/moinwiki/moin-1.9/releases/tag/1.9.11Release Notes, Third Party Advisory
• https://github.com/moinwiki/moin-1.9/security/advisories/GHSA-4q96-6xhq-ff43Third Party Advisory
• https://advisory.checkmarx.net/advisory/CX-2020-4285Exploit, Third Party Advisory
• https://github.com/moinwiki/moin-1.9/commit/31de9139d0aabc171e94032168399b4a0b2a88a2Patch, Third Party Advisory
• https://github.com/moinwiki/moin-1.9/releases/tag/1.9.11Release Notes, Third Party Advisory
• https://github.com/moinwiki/moin-1.9/security/advisories/GHSA-4q96-6xhq-ff43Third Party Advisory

Published

Nov 11, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-1527An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-15270Parse Server (npm package parse-server) broadcasts events to…4.3
• CVE-2020-15271In lookatme (python/pypi package) versions prior to 2.3.0, t…8.8
• CVE-2020-15272In the git-tag-annotation-action (open source GitHub Action)…9.6
• CVE-2020-15273baserCMS before version 4.4.1 is vulnerable to Cross-Site Sc…8.1
• CVE-2020-15274In Wiki.js before version 2.5.162, an XSS payload can be inj…5.4
• CVE-2020-15276baserCMS before version 4.4.1 is vulnerable to Cross-Site Sc…8.7
• CVE-2020-15277baserCMS before version 4.4.1 is affected by Remote Code Exe…7.2
• CVE-2020-15278Red Discord Bot before version 3.4.1 has an unauthorized pri…7.5
• CVE-2020-15279An Improper Access Control vulnerability in the logging comp…3.3
• CVE-2020-1528An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-15281Rejected reason: Unused CVE for 2020