inc/init.php in DokuWiki 2009-02-14, rc2009-02-06, and rc2009-01-30, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via the config_cascade[main][default][] parameter to doku.php. NOTE: PHP remote file inclusion is also possible in PHP 5 using ftp:// URLs.
oryginał ENAV:N/AC:M/Au:N/C:C/I:C/A:CDokuwiki
APPDokuwiki2009-02-14rc2009-01-30rc2009-02-06
Powiązane podatności
CSV Injection (aka Excel Macro Injection or Formula Injection) in /lib/plugins/usermanager/admin.php in DokuWi...
The call parameter of /lib/exe/ajax.php in DokuWiki through 2017-02-19e does not properly encode user input, w...
The sendRequest method in HTTPClient Class in file /inc/HTTPClient.php in DokuWiki 2016-06-26a and older, when...
A typo in the administrator permission check in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki befo...
An issue in Dokuwiki v.2025-05-14b "Librarian" [56.2] allows a remote attacker to cause a denial of service vi...