CVE-2025-13469: Improper Neutralization of Input During Web Page Generation

A security vulnerability has been detected in Public Knowledge Project omp and ojs 3.3.0/3.4.0/3.5.0. Impacted is an unknown function of the file plugins/paymethod/manual/templates/paymentForm.tpl of the component Payment Instructions Setting Handler. The manipulation of the argument...

EUVD-2017-11410

Malware in sbrugna...

EUVD-2013-6567

Malware in sbrugna...

MAL-2025-12819 Malicious code in @zalastax/nolb-omp (npm)

The package @zalastax/nolb-omp was found to contain malicious code...

Malicious code in @zalastax/nolb-omp (npm)

The package @zalastax/nolb-omp was found to contain malicious code...

CVE-2024-50965

Cross Site Scripting vulnerability in Public Knowledge Project PKP Platform OJS/OMP/OPS- before v.3.3.0.16 allows an attacker to execute arbitrary code and escalate privileges via a crafted script...

CVE-2024-56525

In Public Knowledge Project PKP OJS, OMP, and OPS before 3.3.0.21 and 3.4.x before 3.4.0.8, an XXE attack by the Journal Editor Role can create a new role as super admin in the journal context, and insert a backdoor plugin, by uploading a crafted XML document as a User XML Plugin...

PT-2025-7800

Name of the Vulnerable Software and Affected Versions Public Knowledge Project PKP OJS versions prior to 3.3.0.21 Public Knowledge Project PKP OMP versions prior to 3.3.0.21 Public Knowledge Project PKP OPS versions prior to 3.3.0.21 Public Knowledge Project PKP OJS versions 3.4.x prior to 3.4.0....

CVE-2024-56525: Incorrect Default Permissions

In Public Knowledge Project PKP OJS, OMP, and OPS before 3.3.0.21 and 3.4.x before 3.4.0.8, an XXE attack by the Journal Editor Role can create a new role as super admin in the journal context, and insert a backdoor plugin, by uploading a crafted XML document as a User XML Plugin...

CVE-2024-56525

In Public Knowledge Project PKP OJS, OMP, and OPS before 3.3.0.21 and 3.4.x before 3.4.0.8, an XXE attack by the Journal Editor Role can create a new role as super admin in the journal context, and insert a backdoor plugin, by uploading a crafted XML document as a User XML Plugin...

CVE-2024-50965

Cross Site Scripting vulnerability in Public Knowledge Project PKP Platform OJS/OMP/OPS- before v.3.3.0.16 allows an attacker to execute arbitrary code and escalate privileges via a crafted script...

CVE-2024-50965: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in Public Knowledge Project PKP Platform OJS/OMP/OPS- before v.3.3.0.16 allows an attacker to execute arbitrary code and escalate privileges via a crafted script...

CVE-2024-50965

The Public Knowledge Project PKP Platform OJS/OMP/OPS is affected by a Cross Site Scripting (XSS) vulnerability in versions prior to v.3.3.0.16 . This flaw allows an attacker to execute arbitrary code and escalate privileges by delivering a crafted script. To remediate this issue, users should up...

SUSE CVE-2012-5520

The sendtosourcefire function in managesql.c in OpenVAS Manager 3.x before 3.0.4 allows remote attackers to execute arbitrary commands via the 1 IP address or 2 port number field in an OMP request...

SUSE CVE-2014-9220

SQL injection vulnerability in OpenVAS Manager before 4.0.6 and 5.x before 5.0.7 allows remote attackers to execute arbitrary SQL commands via the timezone parameter in a modifyschedule OMP command...

Cross-site Scripting (XSS) - Reflected in pkp/omp

✍️ Description i was able to perform a Reflected XSS against your website/repository. The Reflected XSS vulnerability occurs when the data provided by the attacker is not sanitized by the server, and then reflected "normal" pages returned to other users in the course of regular browsing. Proof of...

Avora Center omp-appmanager Module Access Control

The vulnerability of the omp-appmanager module for mobile applications, which is part of the “Avora Center” application software, relates to the provision of unprivileged accounts for the privileged API used for installing and removing applications. Exploiting this vulnerability could allow a...

PT-2021-3177

Name of the Vulnerable Software and Affected Versions Аврора Центр affected versions not specified Description The issue is related to the omp-appmanager module of the Аврора Центр software, which provides privileged API access to non-privileged user accounts for installing and removing mobile...

CVE-2018-12588

Cross-site scripting XSS vulnerability in templates/frontend/pages/searchResults.tpl in Public Knowledge Project PKP Open Monograph Press OMP v1.2.0 through 3.1.1-2 before 3.1.1-3 allows remote attackers to inject arbitrary web script or HTML via the catalog.noTitlesSearch parameter aka the Searc...

CVE-2018-12588

The CVE concerns a cross-site scripting (XSS) vulnerability in PKP Open Monograph Press (OMP) templates/frontend/pages/searchResults.tpl. Affected versions are PKP OMP 1.2.0 through 3.1.1-2 (before 3.1.1-3). The issue allows remote attackers to inject arbitrary script/HTML via the catalog.noTitle...