CVE-2019-25338
Dokuwiki 2018-04-22b - Username Enumeration
- State
- Published
- Severity
- 6.9 Medium
- Published
- Feb 12, 2026
- Updated
- Mar 5, 2026
- Reserved
- Feb 12, 2026
Description
DokuWiki 2018-04-22b contains a username enumeration vulnerability in its password reset functionality that allows attackers to identify valid user accounts. Attackers can submit different usernames to the password reset endpoint and distinguish between existing and non-existing accounts by analyzing the server's error response messages.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | VulnCheck |
Weaknesses
- CWE-204 Observable Response Discrepancy
Affected Products
| Product | Versions |
|---|---|
DokuwikiDokuwiki |
|
References
- ExploitDB-47731exploit
- DokuWiki Official Homepageproduct
- DokuWiki Download Pageproduct
- VulnCheck Advisory: Dokuwiki 2018-04-22b - Username Enumerationthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.