/Vulnerability Library

DokuWiki <= 2025-05-14a Librarian - Reflected Cross-Site Scripting

CVE-2025-61224
Verified

Description

DokuWiki 2025-05-14a 'Librarian' contains a stored XSS caused by improper sanitization of the 'q' parameter, letting remote attackers execute arbitrary scripts, exploit requires no special privileges.

Severity

Medium

CVSS Score

6.1

Exploit Probability

1%

Affected Product

dokuwiki

Published Date

June 16, 2026

Template Author

lolkatz, 0x_akoko

CVE-2025-61224.yaml
6.1Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVE ID:
cve-2025-61224
CWE ID:
cwe-79

References

https://github.com/dokuwiki/dokuwiki/issues/4512https://github.com/MarioTesoro/vulnerability-research/tree/main/CVE-2025-61224https://nvd.nist.gov/vuln/detail/CVE-2025-61224

Remediation Steps

Update to the latest version of DokuWiki.