What’s Vulnerable › Vulnerabilities

CVE-2016-7964

• Severity: high (CVSS 8.6 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2016-10-31 · updated 2026-06-17
• Weakness: CWE-918

Description

The sendRequest method in HTTPClient Class in file /inc/HTTPClient.php in DokuWiki 2016-06-26a and older, when media file fetching is enabled, has no way to restrict access to private networks. This allows users to scan ports of internal networks via SSRF, such as 10.0.0.1/8, 172.16.0.0/12, and 192.168.0.0/16.

Affected products

• DokuWiki: 2016-06-26a

References

• http://www.securityfocus.com/bid/94245
• https://github.com/splitbrain/dokuwiki/issues/1708
• http://www.securityfocus.com/bid/94245
• https://github.com/splitbrain/dokuwiki/issues/1708

Get alerted when CVE-2016-7964 or the next vulnerability affects your stack