CVE-2025-13469: Improper Neutralization of Input During Web Page Generation

A security vulnerability has been detected in Public Knowledge Project omp and ojs 3.3.0/3.4.0/3.5.0. Impacted is an unknown function of the file plugins/paymethod/manual/templates/paymentForm.tpl of the component Payment Instructions Setting Handler. The manipulation of the argument...

EUVD-2017-11410

Malware in sbrugna...

EUVD-2013-6567

Malware in sbrugna...

Malicious code in @zalastax/nolb-omp (npm)

The package @zalastax/nolb-omp was found to contain malicious code...

MAL-2025-12819 Malicious code in @zalastax/nolb-omp (npm)

The package @zalastax/nolb-omp was found to contain malicious code...

CVE-2024-50965

Cross Site Scripting vulnerability in Public Knowledge Project PKP Platform OJS/OMP/OPS- before v.3.3.0.16 allows an attacker to execute arbitrary code and escalate privileges via a crafted script...

CVE-2024-56525

In Public Knowledge Project PKP OJS, OMP, and OPS before 3.3.0.21 and 3.4.x before 3.4.0.8, an XXE attack by the Journal Editor Role can create a new role as super admin in the journal context, and insert a backdoor plugin, by uploading a crafted XML document as a User XML Plugin...

PT-2025-7800

Name of the Vulnerable Software and Affected Versions Public Knowledge Project PKP OJS versions prior to 3.3.0.21 Public Knowledge Project PKP OMP versions prior to 3.3.0.21 Public Knowledge Project PKP OPS versions prior to 3.3.0.21 Public Knowledge Project PKP OJS versions 3.4.x prior to 3.4.0....

CVE-2024-56525: Incorrect Default Permissions

In Public Knowledge Project PKP OJS, OMP, and OPS before 3.3.0.21 and 3.4.x before 3.4.0.8, an XXE attack by the Journal Editor Role can create a new role as super admin in the journal context, and insert a backdoor plugin, by uploading a crafted XML document as a User XML Plugin...

CVE-2024-50965: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in Public Knowledge Project PKP Platform OJS/OMP/OPS- before v.3.3.0.16 allows an attacker to execute arbitrary code and escalate privileges via a crafted script...

CVE-2024-50965

The Public Knowledge Project PKP Platform OJS/OMP/OPS is affected by a Cross Site Scripting (XSS) vulnerability in versions prior to v.3.3.0.16 . This flaw allows an attacker to execute arbitrary code and escalate privileges by delivering a crafted script. To remediate this issue, users should up...

SUSE CVE-2012-5520

The sendtosourcefire function in managesql.c in OpenVAS Manager 3.x before 3.0.4 allows remote attackers to execute arbitrary commands via the 1 IP address or 2 port number field in an OMP request...

SUSE CVE-2014-9220

SQL injection vulnerability in OpenVAS Manager before 4.0.6 and 5.x before 5.0.7 allows remote attackers to execute arbitrary SQL commands via the timezone parameter in a modifyschedule OMP command...

Cross-site Scripting (XSS) - Reflected in pkp/omp

✍️ Description i was able to perform a Reflected XSS against your website/repository. The Reflected XSS vulnerability occurs when the data provided by the attacker is not sanitized by the server, and then reflected "normal" pages returned to other users in the course of regular browsing. Proof of...

The vulnerability of the omp-appmanager module for mobile applications within the application software “Avora Center” is related to deficiencies in access control in the isolated environment. This vulnerability allows a malicious individual to perform installation or deletion of mobile applications.

The vulnerability of the omp-appmanager module for mobile applications, which is part of the “Avora Center” application software, relates to the provision of unprivileged accounts for the privileged API used for installing and removing applications. Exploiting this vulnerability could allow a...

CVE-2018-12588

The CVE concerns a cross-site scripting (XSS) vulnerability in PKP Open Monograph Press (OMP) templates/frontend/pages/searchResults.tpl. Affected versions are PKP OMP 1.2.0 through 3.1.1-2 (before 3.1.1-3). The issue allows remote attackers to inject arbitrary script/HTML via the catalog.noTitle...

CVE-2018-12588: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in templates/frontend/pages/searchResults.tpl in Public Knowledge Project PKP Open Monograph Press OMP v1.2.0 through 3.1.1-2 before 3.1.1-3 allows remote attackers to inject arbitrary web script or HTML via the catalog.noTitlesSearch parameter aka the Searc...

lockwoodpressonline.com XSS vulnerability

Open Bug Bounty ID: OBB-633510 Description| Value ---|--- Affected Website:| lockwoodpressonline.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| OMP 3.X Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

pblpubs.org XSS vulnerability

Open Bug Bounty ID: OBB-633509 Description| Value ---|--- Affected Website:| pblpubs.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| OMP 1.2 Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

sci-en-tech.com XSS vulnerability

Open Bug Bounty ID: OBB-633507 Description| Value ---|--- Affected Website:| sci-en-tech.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| OMP 1.2 Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...