CVE-2014-9253

The default file type whitelist configuration in conf/mime.conf in the Media Manager in DokuWiki before 2014-09-29b allows remote attackers to execute arbitrary web script or HTML by uploading an SWF file, then accessing it via the media parameter to lib/exe/fetch.php.

• CWE-79

• http://advisories.mageia.org/MGASA-2014-0540.htmlThird Party Advisory
• http://seclists.org/oss-sec/2014/q4/1050Third Party Advisory, VDB Entry
• http://security.szurek.pl/dokuwiki-20140929a-xss.htmlThird Party Advisory
• http://www.securityfocus.com/bid/71671Not Applicable
• http://www.securitytracker.com/id/1031369Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/99291
• https://github.com/splitbrain/dokuwiki/commit/778ddf6f2cd9ed38b9db2d73e823b8c21243a960Issue Tracking, Patch
• https://www.dokuwiki.org/changesRelease Notes
• http://advisories.mageia.org/MGASA-2014-0540.htmlThird Party Advisory
• http://seclists.org/oss-sec/2014/q4/1050Third Party Advisory, VDB Entry
• http://security.szurek.pl/dokuwiki-20140929a-xss.htmlThird Party Advisory
• http://www.securityfocus.com/bid/71671Not Applicable
• http://www.securitytracker.com/id/1031369Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/99291
• https://github.com/splitbrain/dokuwiki/commit/778ddf6f2cd9ed38b9db2d73e823b8c21243a960Issue Tracking, Patch
• https://www.dokuwiki.org/changesRelease Notes

Published

Dec 17, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-9247Zenoss Core through 5 Beta 3 allows remote authenticated use…
• CVE-2014-9248Zenoss Core through 5 Beta 3 does not require complex passwo…
• CVE-2014-9249The default configuration of Zenoss Core before 5 allows rem…
• CVE-2014-9250Zenoss Core through 5 Beta 3 does not include the HTTPOnly f…
• CVE-2014-9251Zenoss Core through 5 Beta 3 uses a weak algorithm to hash p…
• CVE-2014-9252Zenoss Core through 5 Beta 3 stores cleartext passwords in t…
• CVE-2014-9254bb_func_unsub.php in MiniBB 3.1 before 20141127 uses an inco…
• CVE-2014-9258SQL injection vulnerability in ajax/getDropdownValue.php in …
• CVE-2014-9260The basic_settings function in the download manager plugin f…8.8
• CVE-2014-9261The sanitize function in Codoforum 2.5.1 does not properly i…
• CVE-2014-9262The Duplicator plugin in Wordpress before 0.5.10 allows remo…
• CVE-2014-9263Multiple buffer overflows in the PocketNetNVRMediaClientAxCt…