Pkp Ojs Cross Site Scripting Vulnerability

affinitybridge Pkp Ojs is an open source journal publication management software system from affinitybridge. A cross-site scripting vulnerability exists in Pkp Ojs version v3.3, which originates from a vulnerability that allows an attacker to execute arbitrary web script or HTML using a crafted...

CVE-2024-25438

A cross-site scripting (XSS) vulnerability exists in the Submission module (also referred to as the Production module) of Pkp Ojs v3.3 . This flaw allows an attacker to execute arbitrary web scripts or HTML by injecting a crafted payload into the Input subject field within the Add Discussion func...

CVE-2024-25436

CVE-2024-25436 is an XSS vulnerability in PKP Open Journal Systems (PKP OJS) v3.3, affecting the Production/Submission flow where a crafted payload in the Add Discussion subject input can execute arbitrary scripts in the victim’s browser. The cited sources consistently describe the vulnerability ...

CVE-2024-24511

Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the Input Title component...

CVE-2024-25434

A cross-site scripting XSS vulnerability in Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Publicname parameter...

PT-2024-20940 · Public Knowledge · Pkp Ojs

Name of the Vulnerable Software and Affected Versions: Pkp Ojs version 3.3 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Publicname parameter. Recommendations: For Pkp Ojs version 3.3, consider...

CVE-2023-5894

Cross-site Scripting XSS - Stored in GitHub repository pkp/ojs prior to 3.3.0-16...

CVE-2023-5894 Cross-site Scripting (XSS) - Stored in pkp/ojs

Cross-site Scripting XSS - Stored in GitHub repository pkp/ojs prior to 3.3.0-16...

CVE-2023-5894 Cross-site Scripting (XSS) - Stored in pkp/ojs

Cross-site Scripting XSS - Stored in GitHub repository pkp/ojs prior to 3.3.0-16...

PT-2023-32401 · Pkp/Ojs · Pkp Ojs

Name of the Vulnerable Software and Affected Versions: pkp/ojs versions prior to 3.3.0-16 Description: The issue is related to Cross-site Scripting XSS - Stored, which affects the GitHub repository pkp/ojs. Recommendations: For versions prior to 3.3.0-16, update to version 3.3.0-16 or later to...

CVE-2023-5626

Cross-Site Request Forgery CSRF in GitHub repository pkp/ojs prior to 3.3.0-16...

CVE-2023-5626 Cross-Site Request Forgery (CSRF) in pkp/ojs

Cross-Site Request Forgery CSRF in GitHub repository pkp/ojs prior to 3.3.0-16...

CVE-2023-5626 Cross-Site Request Forgery (CSRF) in pkp/ojs

Cross-Site Request Forgery CSRF in GitHub repository pkp/ojs prior to 3.3.0-16...

CVE-2023-5626

CVE-2023-5626 affects Open Journal Systems (OJS) pkp/ojs versions prior to 3.3.0-16. Root cause is a Cross-Site Request Forgery (CSRF) vulnerability. The impact is described as high in CVSS metrics (C/H, I/H, A/H) for the NVD entry; exploitation may allow unauthorized actions requiring user inter...

CVE-2023-5626 Cross-Site Request Forgery (CSRF) in pkp/ojs

Cross-Site Request Forgery CSRF in GitHub repository pkp/ojs prior to 3.3.0-16...

Sensitive Cookie Without 'HttpOnly' Flag in pkp/ojs

✍️ Description HTTPOnly attribute is not set for session cookies "OJSSID" in the application. Proof of Concept Check this for POC: Image Impact When a cookie doesn’t have an HttpOnly flag, it can be accessed through JavaScript, which means that an XSS could lead to cookies being stolen. These...

Cross site scripting

Cross-site scripting XSS vulnerability in Public Knowledge Project PKP Open Journal System OJS 3.0.0 to 3.1.1-1 allows remote attackers to inject arbitrary web script or HTML via the templates/frontend/pages/search.tpl parameter aka the By Author field...