CVE-2023-34408
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
DokuWiki before version 2023-04-04a allows XSS via RSS titles.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious JavaScript code, potentially leading to user data theft or session hijacking.
Recommendation
It is recommended to update DokuWiki to version 2023-04-04a or later to mitigate this vulnerability.
Other vulnerabilities in DokuWiki
See all- CVE-2026-37106Critical
In DokuWiki 2025-05-14b 'Librarian' 56.2, a remote attacker can create an account via the register function in inc/auth.php. The supplier disputes this as a vulnerability, stating it is intentional behavior when self-registration is enabled (a non-default feature) and there is no scenario where it would be enabled without administrator knowledge.
- CVE-2026-26477Medium
Dokuwiki version 2025-05-14b has a denial of service vulnerability in the media_upload_xhr() function in media.php. A remote attacker can cause a denial of service.
Original NVD description (English source)
DokuWiki before 2023-04-04a allows XSS via RSS titles.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS