PKP Open Journal Systems 2.4.8-3.3 - Cross-Site Scripting

PKP Open Journal Systems 2.4.8 to 3.3 contains a cross-site scripting vulnerability which allows remote attackers to inject arbitrary code via the X-Forwarded-Host Header. id: CVE-2022-24181 info: name: PKP Open Journal Systems 2.4.8-3.3 - Cross-Site Scripting author: lucasljm2001,ekrause severit...

CVE-2026-111609

PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequential ids through editSubscription to view...

CVE-2026-111609

PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequential ids through editSubscription to view...

CVE-2026-111609 PKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via updateSubscription

PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequential ids through editSubscription to view...

CVE-2026-111609 PKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via updateSubscription

PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequential ids through editSubscription to view...

CVE-2026-111609 PKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via updateSubscription

PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequential ids through editSubscription to view...

CVE-2026-111609

PKP Open Journal Systems versions through 3.5.0-5 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability. This flaw allows authorized journal or subscription managers to access subscriptions from other journals by providing arbitrary subscription ids . Specifically, attackers ...

EUVD-2026-103031

PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequential ids through editSubscription to view...

CVE-2026-111609: Authorization Bypass Through User-Controlled Key

PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequential ids through editSubscription to view...

PT-2026-116008

Name of the Vulnerable Software and Affected Versions PKP Open Journal Systems versions prior to 3.5.0-6 Description An insecure direct object reference occurs when an application provides direct access to objects based on user-supplied input. This issue allows journal or subscription managers to...

Public Knowledge Project Open Journal Systems Authorization Issues Vulnerabilities

The Public Knowledge Project Open Journal Systems 3.5.0-5 version has an authorization issue vulnerability. This vulnerability stems from insecure direct object references, allowing journal or subscription administrators to access subscriptions to other journals by providing arbitrary subscriptio...

PKP Open Journal Systems 2.4.8-3.3 - Cross-Site Scripting Detection

PKP Open Journal Systems 2.4.8 to 3.3 contains a cross-site scripting vulnerability which allows remote attackers to inject arbitrary code via the X-Forwarded-Host Header. !/usr/bin/env python3 -- coding: utf-8 -- """PKP Open Journal Systems 2.""" from kittysploit import from...

Open Journal Systems Detect

Open Journal Systems, also known as OJS, is a free software for the management of peer-reviewed academic journals, created by the Public Knowledge Project. !/usr/bin/env python3 -- coding: utf-8 -- """Open Journal Systems, also known as OJS, is a free software for the management of peer-reviewed...

Open Journal Systems Installer - Exposure Detection

Open Journal Systems is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Open Journal Systems is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient...

Open Journal Systems pkp-lib - Open Redirect Detection

Public Knowledge Project pkp-lib is vulnerable to Open redirect due to a lack of input sanitization in the setLocale function. !/usr/bin/env python3 -- coding: utf-8 -- """Public Knowledge Project pkp-lib is vulnerable to Open redirect due to a lack of input sanitization in the set.""" import re...

📄 PKP-WAL 3.5.0-1 Cross Site Request Forgery

PKP-WAL versions 3.5.0-1 and below suffer from a cross site request forgery vulnerability. ----------------------------------------------------------------- PKP-WAL = 3.5.0-1 Login Cross-Site Request Forgery Vulnerability ----------------------------------------------------------------- - Softwar...

📄 Open Journal Systems 3.5.0-1 Path Traversal

Open Journal Systems versions 3.5.0-1 and below suffer from a path traversal vulnerability in NativeXmlIssueGalleyFilter.php. --------------------------------------------------------------------------------------------- Open Journal Systems issuegalleys - issuegalley - issuefile - filename tag of...

CVE-2025-13469

A security vulnerability has been detected in Public Knowledge Project omp and ojs 3.3.0/3.4.0/3.5.0. Impacted is an unknown function of the file plugins/paymethod/manual/templates/paymentForm.tpl of the component Payment Instructions Setting Handler. The manipulation of the argument...

CVE-2025-13469

A security vulnerability has been detected in Public Knowledge Project omp and ojs 3.3.0/3.4.0/3.5.0. Impacted is an unknown function of the file plugins/paymethod/manual/templates/paymentForm.tpl of the component Payment Instructions Setting Handler. The manipulation of the argument...

CVE-2025-13469 Public Knowledge Project omp/ojs Payment Instructions Setting paymentForm.tpl cross site scripting

A security vulnerability has been detected in Public Knowledge Project omp and ojs 3.3.0/3.4.0/3.5.0. Impacted is an unknown function of the file plugins/paymethod/manual/templates/paymentForm.tpl of the component Payment Instructions Setting Handler. The manipulation of the argument...