Skip to content
OpenAdvisories

Package · Ubuntu

dokuwiki

15 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

15 results · Feed

  • High 7.5
    CVE-2026-113356

    DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition

    DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to…

    DokuWiki DokuWiki dokuwiki dokuwiki Debian Ubuntu
  • Critical 9.8
    CVE-2026-37106

    An issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remote attacker to create an account via the register functi…

    dokuwiki Ubuntu
  • Medium 4.3
    CVE-2026-26477

    An issue in Dokuwiki v.2025-05-14b "Librarian" [56.2] allows a remote attacker to cause a denial of service via the med…

    DokuWiki DokuWiki dokuwiki dokuwiki Debian Ubuntu
  • Medium 5.3
    CVE-2019-25338

    Dokuwiki 2018-04-22b - Username Enumeration

    DokuWiki 2018-04-22b contains a username enumeration vulnerability in its password reset functionality that allows attackers to identify valid user accounts. Attackers can submit different usernames to the password reset endpoint and distinguish between exist…

    DokuWiki DokuWiki dokuwiki dokuwiki Ubuntu PyPI
  • Medium 6.5
    CVE-2025-61224 Scanner template

    Cross Site Scripting vulnerability in DokuWiki 2025-05-14a 'Librarian'[56.1] allows a remote attacker to execute arbitr…

    dokuwiki dokuwiki Debian Ubuntu
  • Medium 5.4
    CVE-2023-34408

    DokuWiki before 2023-04-04a allows XSS via RSS titles.

    dokuwiki dokuwiki Debian Ubuntu
  • Medium 5.4
    CVE-2022-3123

    Cross-site Scripting (XSS) - Reflected in splitbrain/dokuwiki

    Cross-site Scripting (XSS) - Reflected in GitHub repository splitbrain/dokuwiki prior to 2022-07-31a.

    splitbrain splitbrain/dokuwiki dokuwiki Ubuntu
  • Unscored —
    CVE-2022-28919

    HTMLCreator release_stable_2020-07-29 was discovered to contain a cross-site scripting (XSS) vulnerability via the func…

    dokuwiki dokuwiki Debian Ubuntu
  • Unscored —
    CVE-2017-18123

    The call parameter of /lib/exe/ajax.php in DokuWiki through 2017-02-19e does not properly encode user input, which lead…

    dokuwiki dokuwiki Debian Ubuntu
  • Unscored —
    CVE-2017-12979

    DokuWiki through 2017-02-19c has stored XSS when rendering a malicious language name in a code element, in /inc/parser/…

    dokuwiki dokuwiki Debian Ubuntu
  • Unscored —
    CVE-2017-12980

    DokuWiki through 2017-02-19c has stored XSS when rendering a malicious RSS or Atom feed, in /inc/parser/xhtml.php. An a…

    dokuwiki dokuwiki Debian Ubuntu
  • Unscored —
    CVE-2017-12583 Scanner template

    DokuWiki through 2017-02-19b has XSS in the at parameter (aka the DATE_AT variable) to doku.php.

    dokuwiki dokuwiki Debian Ubuntu
  • Unscored —
    CVE-2016-7964

    The sendRequest method in HTTPClient Class in file /inc/HTTPClient.php in DokuWiki 2016-06-26a and older, when media fi…

    dokuwiki dokuwiki Debian Ubuntu
  • Unscored —
    CVE-2016-7965

    DokuWiki 2016-06-26a and older uses $_SERVER[HTTP_HOST] instead of the baseurl setting as part of the password-reset UR…

    dokuwiki dokuwiki Debian Ubuntu
  • Unscored —
    CVE-2011-3727

    DokuWiki 2009-12-25c allows remote attackers to obtain sensitive information via a direct request to a .php file, which…

    dokuwiki Ubuntu