MoinMoin 1.9.8 allows remote attackers to conduct \JavaScript injection\ attacks by using the \page creation or crafted URL\ approach related to a \Cross Site Scripting (XSS)\ issue affecting the action=fckdialog&dialog=attachment (via page name) component.