DO
Product
Dokuwiki
26
CVEs
0
On KEV
9.6
Max CVSS
1
New 30D
Severity mix
Critical 1High 3Medium 9Low 0
Watch
Add Dokuwiki to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-15474 | 9.6 | Sep 7 | CSV Injection (aka Excel Macro Injection or Formula Injection) in /lib/plugins/usermanager/admin.php in DokuWiki 2018-04-22a and earlier allows remote attackers to exfiltrate… Affected: through 2018-04-22a |
| CVE-2017-18123 | 8.6 | Feb 3 | The call parameter of /lib/exe/ajax.php in DokuWiki through 2017-02-19e does not properly encode user input, which leads to a reflected file download vulnerability, and allows… Affected: through 2017-02-19e |
| CVE-2016-7964 | 8.6 | Oct 31 | The sendRequest method in HTTPClient Class in file /inc/HTTPClient.php in DokuWiki 2016-06-26a and older, when media file fetching is enabled, has no way to restrict access to… Affected: 2016-06-26a |
| CVE-2026-113356 | 7.5 | Oct 20 | DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition Affected: before 2026-07-14c |
| CVE-2016-7965 | 6.5 | Oct 31 | DokuWiki 2016-06-26a and older uses $_SERVER[HTTP_HOST] instead of the baseurl setting as part of the password-reset URL Affected: through 2016-06-26a |
| CVE-2022-3123 | 6.1 | Sep 5 | Cross-site Scripting (XSS) - Reflected in GitHub repository splitbrain/dokuwiki prior to 2022-07-31a Affected: before 2022-07-31a |
| CVE-2022-28919 | 6.1 | May 12 | HTMLCreator release_stable_2020-07-29 was discovered to contain a cross-site scripting (XSS) vulnerability via the function _generateFilename Affected: 2020-07-29 |
| CVE-2017-12980 | 6.1 | Aug 21 | DokuWiki through 2017-02-19c has stored XSS when rendering a malicious RSS or Atom feed, in /inc/parser/xhtml.php Affected: through 2017-02-19c |
| CVE-2017-12979 | 6.1 | Aug 21 | DokuWiki through 2017-02-19c has stored XSS when rendering a malicious language name in a code element, in /inc/parser/xhtml.php Affected: through 2017-02-19c |
| CVE-2017-12583 | 6.1 | Aug 6 | DokuWiki through 2017-02-19b has XSS in the at parameter (aka the DATE_AT variable) to doku.php Affected: through 2017-02-19b |
| CVE-2023-34408 | 5.4 | Jun 5 | DokuWiki before 2023-04-04a allows XSS via RSS titles Affected: before 2023-04-04a |
| CVE-2019-25338 | 5.3 | Feb 12 | Dokuwiki 2018-04-22b - Username Enumeration Affected: 2018-04-22b "Greebo" |
| CVE-2026-26477 | 4.3 | Apr 3 | An issue in Dokuwiki v.2025-05-14b "Librarian" [56.2] allows a remote attacker to cause a denial of service via the media_upload_xhr() function in the media.php file Affected: 2025-05-14b |
| CVE-2015-2172 | – | Mar 30 | DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticated users to gain privileges and add or… Affected: 2014-05-05 before 2014-05-05d; 2014-09-29 before 2014-09-29c |
| CVE-2014-9253 | – | Dec 17 | The default file type whitelist configuration in conf/mime.conf in the Media Manager in DokuWiki before 2014-09-29b allows remote attackers to execute arbitrary web script or HTML… Affected: through 2014-05-05c |
| CVE-2014-8764 | – | Oct 22 | DokuWiki 2014-05-05a and earlier, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a user name and password starting with… Affected: through 2013-12-08 |
| CVE-2014-8763 | – | Oct 22 | DokuWiki before 2014-05-05b, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a password starting with a null (\0)… Affected: through 2014-05-05a |
| CVE-2014-8762 | – | Oct 22 | The ajax_mediadiff function in DokuWiki before 2014-05-05a allows remote attackers to access arbitrary images via a crafted namespace in the ns parameter Affected: through 2013-12-08 |
| CVE-2014-8761 | – | Oct 22 | inc/template.php in DokuWiki before 2014-05-05a only checks for access to the root namespace, which allows remote attackers to access arbitrary images via a media file details… Affected: through 2013-12-08 |
| CVE-2012-3354 | – | Nov 20 | doku.php in DokuWiki, as used in Fedora 16, 17, and 18, when certain PHP error levels are set, allows remote attackers to obtain sensitive information via the prefix parameter,… Affected: All versions, or not specified |
| CVE-2011-3727 | – | Sep 23 | DokuWiki 2009-12-25c allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as… Affected: 2009-12-25c |
| CVE-2011-2510 | – | Jul 14 | Cross-site scripting (XSS) vulnerability in the RSS embedding feature in DokuWiki before 2011-05-25a Rincewind allows remote attackers to inject arbitrary web script or HTML via a… Affected: through 2010-11-07a; 2005-07-01; 2005-07-13; 2005-09-19; 2005-09-22; 2006-03-05; +6 more |
| CVE-2010-0289 | – | Feb 15 | Multiple cross-site request forgery (CSRF) vulnerabilities in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25c allow remote attackers to hijack the… Affected: through release_2009-02-14; 2004-07-04; 2004-07-07; 2004-07-12; 2004-07-21; 2004-07-25; +23 more |
| CVE-2010-0288 | – | Feb 15 | A typo in the administrator permission check in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote attackers to gain privileges and access… Affected: through release_2009-02-14; 2004-07-04; 2004-07-07; 2004-07-12; 2004-07-21; 2004-07-25; +23 more |
| CVE-2010-0287 | – | Feb 15 | Directory traversal vulnerability in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote attackers to list the contents of arbitrary… Affected: through release_2009-02-14; 2004-07-04; 2004-07-07; 2004-07-12; 2004-07-21; 2004-07-25; +23 more |
| CVE-2009-1960 | – | Jun 8 | inc/init.php in DokuWiki 2009-02-14, rc2009-02-06, and rc2009-01-30, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via the… Affected: 2009-02-14; rc2009-01-30; rc2009-02-06 |
Showing 26