Post #3508274

2026-07-01 06:02 UTC

god I hate the CVE system so much. just discovered another CVE against DokuWiki that was a) never reported and b) totally misrepresents the severity level. any dork can register a CVE in minutes, but disputes by the actual maintainers can take months or are just ignored. and then there are "security researchers" who seem to have decided that their job is to collect CVEs like Pokémon... it's such a shit show

Replies (1)

@splitbrain@fedi.splitbrain.org 2026-07-01 10:21

Okay, after looking into this, the severity level (critical) was not misrepresented, it was total and utter bullshit. The "researcher" merely described a very complicated way to use the user registration form. Some of the various "security websites" that hope to gain traffic by reposting CVE reports are now leading with the headline "DokuWiki allows remote attackers to execute arbitrary code" - a claim not even the original "researcher" made. Did I mention that the entire CVE system is a total shit show?

Open ##3508272