Design/Logic Flaw

PKP-WAL aka PKP Web Application Library or pkp-lib before 3.3.0-16, as used in Open Journal Systems OJS and other products, does not verify that the file named in an XML document used for the native import/export plugin is an image file, before trying to use it for an issue cover image...

PKP Web Application Library Cross-Site Scripting Vulnerability

The PKP Web Application Library is a library shared by PKP's Open Journal System OJS, Open Conference System OCS, Open Monograph Press OMP, Open Preprint System OPS, and Open Harvester System OHS. A cross-site scripting vulnerability exists in the PKP Web Application Library prior to version...

PKP Web Application Library Cross-Site Request Forgery Vulnerability

The PKP Web Application Library is a library shared by PKP's Open Journal System OJS, Open Conference System OCS, Open Monograph Press OMP, Open Preprint System OPS, and Open Harvester System OHS. A cross-site request forgery vulnerability exists in versions prior to PKP Web Application Library...

PKP Web Application Library Cross-Site Scripting Vulnerability

The PKP Web Application Library is a library shared by PKP's Open Journal System OJS, Open Conference System OCS, Open Monograph Press OMP, Open Preprint System OPS, and Open Harvester System OHS. A cross-site scripting vulnerability exists in versions prior to PKP Web Application Library 3.3.0-1...

CVE-2023-47271

PKP-WAL (pkp-lib) before 3.3.0-16, used in OJS and related products, fails to verify that a file named in an XML document (Native Import/Export plugin) is an image before using it as an issue cover image. The issue stems from PKPNativeFilterHelper::parsePublicationCover() in the NativeImportExpor...

PKP customLocale Cross-Site Request Forgery Vulnerability

PKP customLocale is PKP's custom locale plugin for OPS, OJS and OMP. A cross-site request forgery vulnerability exists in PKP customLocale versions prior to 1.2.0-1, which can be exploited by an attacker to send a fake request to a user...

PKP Web Application Library Cross-Site Scripting Vulnerability

The PKP Web Application Library is a library shared by PKP's Open Journal System OJS, Open Conference System OCS, Open Monograph Press OMP, Open Preprint System OPS, and Open Harvester System OHS. A cross-site scripting vulnerability exists in versions prior to PKP Web Application Library 3.3.0-1...

PKP Web Application Library Code Issue Vulnerability

The PKP Web Application Library is a library shared by PKP's Open Journal System OJS, Open Conference System OCS, Open Monograph Press OMP, Open Preprint System OPS, and Open Harvester System OHS. A code issue vulnerability exists in the PKP Web Application Library prior to version 3.3.0-16, whic...

PKP Web Application Library Cross-Site Scripting Vulnerability

The PKP Web Application Library is a library shared by PKP's Open Journal System OJS, Open Conference System OCS, Open Monograph Press OMP, Open Preprint System OPS, and Open Harvester System OHS. A cross-site scripting vulnerability exists in versions prior to PKP Web Application Library 3.3.0-1...

PKP Web Application Library Cross-Site Request Forgery Vulnerability

The PKP Web Application Library is a library shared by PKP's Open Journal System OJS, Open Conference System OCS, Open Monograph Press OMP, Open Preprint System OPS, and Open Harvester System OHS. A cross-site request forgery vulnerability exists in the PKP Web Application Library prior to versio...

PKP Web Application Library Cross-Site Scripting Vulnerability

The PKP Web Application Library is a library shared by PKP's Open Journal System OJS, Open Conference System OCS, Open Monograph Press OMP, Open Preprint System OPS, and Open Harvester System OHS. A cross-site scripting vulnerability exists in versions prior to PKP Web Application Library 3.3.0-1...

PKP Web Application Library Cross-Site Request Forgery Vulnerability

The PKP Web Application Library is a library shared by PKP's Open Journal System OJS, Open Conference System OCS, Open Monograph Press OMP, Open Preprint System OPS, and Open Harvester System OHS. A cross-site request forgery vulnerability exists in versions prior to PKP Web Application Library...

springfieldbusinessjournal.com Cross Site Scripting vulnerability OBB-3770093

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

augsburg-journal.de Improper Access Control vulnerability OBB-3765985

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Open Journal Systems Cross-Site Request Forgery Vulnerability

Open Journal Systems OJS is an open source system for managing peer-reviewed academic journals. A cross-site request forgery vulnerability exists in Open Journal Systems versions prior to 3.3.0-16 that stems from the presence of a cross-site request forgery CSRF vulnerability...

journal-jams.org Cross Site Scripting vulnerability OBB-3722397

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

stored xss using journal-role when user try to export user of any journal

BUG ========== stored xss using journal-role when user try to export user of any journal SUMMURY ========= lower level user can attack higher level user using this xss STEP TO REPRODUCE ================ 1. from Admin account create a journal called "journal-A" .\ \ 2. Admin goto above journal...

STORED XSS in Journal-> Sections

Description Stored attacks are those where the injected script is permanently stored on the target servers, such as in a database, in a message forum, visitor log, comment field, etc. The victim then retrieves the malicious script from the server when it requests the stored information. Stored XS...

Stored xss using journal-name

BUG ======== Stored xss using journal-name ACCOUNT ========== 1. user-A -- superadmin -- Victim -- Firefox browser Normal mode\ 2. user-B -- journal manager -- Attacker -- Firefox browser Container-1\ STEP TO RERPODUCE ====================== 1. From user-A account create a journal called...

Stored xss using journal-name in journal-tab

BUG ======== Stored xss using journal-name in journal-tab ACCOUNT ========== 1. user-A -- superadmin -- Victim -- Firefox browser Normal mode\ 2. user-B -- journal manager -- Attacker -- Firefox browser Container-1\ STEP TO RERPODUCE ====================== 1. From user-A account create a journal...