[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fkv1jtoUS0usUVf7egSjFU2N9jfbifE7HjwL_F_fJCyA":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":19,"kevVulnerabilities":82,"topProductsByCves":83,"seoMetadata":85,"meta":94},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":18},8306,"dokuwiki",1,24,0,131,"2026-04-03","d",[16],{"id":17,"product_name":8,"version_count":12,"cve_count":10,"kev_count":11,"last_cve_update":13},38933,"Dokuwiki is a technology vendor with 1 tracked product and 24 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[20,29,36,42,49,55,61,67,72,76],{"cveId":21,"description":22,"publishedDate":23,"cvssScore":24,"cvssVersion":25,"severity":26,"isKev":27,"epssScore":28},"CVE-2009-1960","inc\u002Finit.php in DokuWiki 2009-02-14, rc2009-02-06, and rc2009-01-30, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via the config_cascade[main][default][] parameter to doku.php.  NOTE: PHP remote file inclusion is also possible in PHP 5 using ftp:\u002F\u002F URLs.","2009-06-08",9.3,"v2","Critical",false,0.23157,{"cveId":30,"description":31,"publishedDate":32,"cvssScore":33,"cvssVersion":25,"severity":34,"isKev":27,"epssScore":35},"CVE-2010-0287","Directory traversal vulnerability in the ACL Manager plugin (plugins\u002Facl\u002Fajax.php) in DokuWiki before 2009-12-25b allows remote attackers to list the contents of arbitrary directories via a .. (dot dot) in the ns parameter.","2010-02-15",5,"Medium",0.10812,{"cveId":37,"description":38,"publishedDate":32,"cvssScore":39,"cvssVersion":25,"severity":40,"isKev":27,"epssScore":41},"CVE-2010-0288","A typo in the administrator permission check in the ACL Manager plugin (plugins\u002Facl\u002Fajax.php) in DokuWiki before 2009-12-25b allows remote attackers to gain privileges and access closed wikis by editing current ACL statements, as demonstrated in the wild in January 2010.",7.5,"High",0.10745,{"cveId":43,"description":44,"publishedDate":45,"cvssScore":46,"cvssVersion":47,"severity":26,"isKev":27,"epssScore":48},"CVE-2018-15474","CSV Injection (aka Excel Macro Injection or Formula Injection) in \u002Flib\u002Fplugins\u002Fusermanager\u002Fadmin.php in DokuWiki 2018-04-22a and earlier allows remote attackers to exfiltrate sensitive data and to execute arbitrary code via a value that is mishandled in a CSV export.  NOTE: the vendor has stated \"this is not a security problem in DokuWiki.","2018-09-07",9.6,"v3.0",0.03334,{"cveId":50,"description":51,"publishedDate":52,"cvssScore":53,"cvssVersion":47,"severity":34,"isKev":27,"epssScore":54},"CVE-2017-12583","DokuWiki through 2017-02-19b has XSS in the at parameter (aka the DATE_AT variable) to doku.php.","2017-08-06",6.1,0.03253,{"cveId":56,"description":57,"publishedDate":58,"cvssScore":59,"cvssVersion":25,"severity":34,"isKev":27,"epssScore":60},"CVE-2015-2172","DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticated users to gain privileges and add or delete ACL rules via a request to the XMLRPC API.","2015-03-30",6.5,0.02862,{"cveId":62,"description":63,"publishedDate":64,"cvssScore":65,"cvssVersion":47,"severity":40,"isKev":27,"epssScore":66},"CVE-2017-18123","The call parameter of \u002Flib\u002Fexe\u002Fajax.php in DokuWiki through 2017-02-19e does not properly encode user input, which leads to a reflected file download vulnerability, and allows remote attackers to run arbitrary programs.","2018-02-03",8.6,0.02596,{"cveId":68,"description":69,"publishedDate":70,"cvssScore":33,"cvssVersion":25,"severity":34,"isKev":27,"epssScore":71},"CVE-2014-8763","DokuWiki before 2014-05-05b, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a password starting with a null (\\0) character and a valid user name, which triggers an unauthenticated bind.","2014-10-22",0.02519,{"cveId":73,"description":74,"publishedDate":70,"cvssScore":33,"cvssVersion":25,"severity":34,"isKev":27,"epssScore":75},"CVE-2014-8762","The ajax_mediadiff function in DokuWiki before 2014-05-05a allows remote attackers to access arbitrary images via a crafted namespace in the ns parameter.",0.02366,{"cveId":77,"description":78,"publishedDate":79,"cvssScore":80,"cvssVersion":25,"severity":34,"isKev":27,"epssScore":81},"CVE-2014-9253","The default file type whitelist configuration in conf\u002Fmime.conf in the Media Manager in DokuWiki before 2014-09-29b allows remote attackers to execute arbitrary web script or HTML by uploading an SWF file, then accessing it via the media parameter to lib\u002Fexe\u002Ffetch.php.","2014-12-17",4.3,0.02365,[],[84],{"id":17,"product_name":8,"version_count":12,"cve_count":10,"kev_count":11,"last_cve_update":13},{"title":86,"metaDescription":87,"keywords":88,"structuredData":89},"Dokuwiki - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Dokuwiki covering 1 product with 24 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Dokuwiki vulnerabilities, Dokuwiki security, Dokuwiki CVE, Dokuwiki threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":90,"@type":91,"name":92,"description":87,"url":93},"https:\u002F\u002Fschema.org","Organization","Dokuwiki","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fdokuwiki",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":95,"apiVersion":96},"2026-10-18T20:16:06.553Z","3.0"]