Username Enumeration Vulnerability in DokuWiki by DokuWiki
CVE-2019-25338

6.9MEDIUM

Key Information:

Vendor

Dokuwiki

Status
Dokuwiki
Vendor
CVE Published:
12 February 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2019-25338?

DokuWiki 2018-04-22b includes a vulnerability in its password reset function that allows malicious users to enumerate valid usernames. By sending various usernames to the password reset endpoint, attackers can assess the server's error messages to discern which usernames are associated with existing accounts. This exploitation risk emphasizes the need for developers to implement more secure error handling and validation mechanisms to protect user data from unauthorized exposure.

Affected Version(s)

Dokuwiki 2018-04-22b "Greebo"

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2019-25338 - Proof of Concept

References

https://www.exploit-db.com/exploits/47731
exploit
https://www.dokuwiki.org/dokuwiki
product
https://download.dokuwiki.org/
product

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Talha ŞEN
.