CVE-2024-25436

A cross-site scripting XSS vulnerability in the Production module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Input subject field under the Add Discussion function...

CVE-2024-25438

CVE-2024-25438 describes a cross-site scripting (XSS) vulnerability in the Submission module of PKP Open Journal Systems (PKP OJS) version 3.3. The issue allows an attacker to inject arbitrary web scripts or HTML via a crafted payload in the Input subject field under the Add Discussion function. ...

CVE-2024-25436

A cross-site scripting XSS vulnerability in the Production module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Input subject field under the Add Discussion function...

PT-2024-20940 · Public Knowledge · Pkp Ojs

Name of the Vulnerable Software and Affected Versions: Pkp Ojs version 3.3 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Publicname parameter. Recommendations: For Pkp Ojs version 3.3, consider...

CVE-2024-24511

Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the Input Title component...

PT-2024-20942 · Public Knowledge · Pkp Ojs

Name of the Vulnerable Software and Affected Versions: Pkp Ojs version 3.3 Description: A cross-site scripting XSS issue in the Production module allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Input subject field under the Add Discussion function...

CVE-2024-24512

CVE-2024-24512 concerns PKP Open Journal Systems (PKP OJS) 3.4. It is a Cross Site Scripting (XSS) vulnerability in the input subtitle component that could allow an attacker to execute arbitrary code. The CVE is documented with a CVSS v3.1 base score of 6.1 (MEDIUM) with network attack vector, lo...

CVE-2024-25436

CVE-2024-25436 is an XSS vulnerability in PKP Open Journal Systems (PKP OJS) v3.3, affecting the Production/Submission flow where a crafted payload in the Add Discussion subject input can execute arbitrary scripts in the victim’s browser. The cited sources consistently describe the vulnerability ...

CVE-2024-24511

CVE-2024-24511 affects PKP OPEN JOURNAL SYSTEMS (PKP OJS) v3.4, with a Cross Site Scripting vulnerability in the Input Title component that could allow an attacker to execute arbitrary code. The public sources consistently cite PKP OJS 3.4 as vulnerable and describe the issue as a stored XSS vect...

Pkp Ojs Cross Site Scripting Vulnerability

affinitybridge Pkp Ojs is an open source journal publication management software system from affinitybridge. A cross-site scripting vulnerability exists in Pkp Ojs version v3.3, which originates from a vulnerability that allows an attacker to execute arbitrary web script or HTML using a crafted...

CVE-2024-25438

A cross-site scripting XSS vulnerability in the Submission module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Input subject field under the Add Discussion function...

CVE-2024-24511

Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the Input Title component...

CVE-2023-6671

A vulnerability has been discovered on OJS, that consists in a CSRF Cross-Site Request Forgery attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated...

Cross site request forgery (csrf)

A vulnerability has been discovered on OJS, that consists in a CSRF Cross-Site Request Forgery attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated...

CVE-2023-6671

CVE-2023-6671 describes a Cross-Site Request Forgery (CSRF) vulnerability in Open Journal Systems (OJS). Public records attribute the flaw to CSRF that can cause an end user, while authenticated, to perform unwanted actions in the application. The NVD entry frames the issue in OJS, with a high-se...

CVE-2023-47271

PKP-WAL (pkp-lib) before 3.3.0-16, used in OJS and related products, fails to verify that a file named in an XML document (Native Import/Export plugin) is an image before using it as an issue cover image. The issue stems from PKPNativeFilterHelper::parsePublicationCover() in the NativeImportExpor...

CVE-2023-5894

Cross-site Scripting XSS - Stored in GitHub repository pkp/ojs prior to 3.3.0-16...

CVE-2023-5894 Cross-site Scripting (XSS) - Stored in pkp/ojs

Cross-site Scripting XSS - Stored in GitHub repository pkp/ojs prior to 3.3.0-16...

CVE-2023-5894 Cross-site Scripting (XSS) - Stored in pkp/ojs

Cross-site Scripting XSS - Stored in GitHub repository pkp/ojs prior to 3.3.0-16...

CVE-2023-5894

CVE-2023-5894 affects PKP Open Journals System (OJS) prior to 3.3.0-16. The vulnerability is a stored XSS in the title handling of pkp/ojs, caused by improper escaping of characters. Impact stated as possible script injection in the affected site. Remediation: upgrade to version 3.3.0-16 or later...