248 matches found
CVE-2024-24512
CVE-2024-24512 concerns PKP Open Journal Systems (PKP OJS) 3.4. It is a Cross Site Scripting (XSS) vulnerability in the input subtitle component that could allow an attacker to execute arbitrary code. The CVE is documented with a CVSS v3.1 base score of 6.1 (MEDIUM) with network attack vector, lo...
CVE-2024-24511
Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the Input Title component...
Pkp Ojs Cross Site Scripting Vulnerability
affinitybridge Pkp Ojs is an open source journal publication management software system from affinitybridge. A cross-site scripting vulnerability exists in Pkp Ojs version v3.3, which originates from a vulnerability that allows an attacker to execute arbitrary web script or HTML using a crafted...
CVE-2024-25436
A cross-site scripting XSS vulnerability in the Production module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Input subject field under the Add Discussion function...
CVE-2024-24512
Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the input subtitle component...
CVE-2024-25434
CVE-2024-25434 affects Pkp Ojs v3.3, with a stored/reflected XSS vulnerability in the Publicname parameter. The available sources describe that arbitrary web scripts/HTML can be executed via crafted input, but do not provide a confirmed exploit method or patch details. CVSS 3.1 base score is 5.4 ...
PT-2024-20940 · Public Knowledge · Pkp Ojs
Name of the Vulnerable Software and Affected Versions: Pkp Ojs version 3.3 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Publicname parameter. Recommendations: For Pkp Ojs version 3.3, consider...
CVE-2024-24511
Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the Input Title component...
CVE-2024-25434
A cross-site scripting XSS vulnerability in Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Publicname parameter...
CVE-2024-25438
CVE-2024-25438 describes a cross-site scripting (XSS) vulnerability in the Submission module of PKP Open Journal Systems (PKP OJS) version 3.3. The issue allows an attacker to inject arbitrary web scripts or HTML via a crafted payload in the Input subject field under the Add Discussion function. ...
CVE-2024-25436
CVE-2024-25436 is an XSS vulnerability in PKP Open Journal Systems (PKP OJS) v3.3, affecting the Production/Submission flow where a crafted payload in the Add Discussion subject input can execute arbitrary scripts in the victim’s browser. The cited sources consistently describe the vulnerability ...
PKP-WAL 3.4.0-3 Remote Code Execution Exploit
PKP Web Application Library PKP-WAL versions 3.4.0-3 and below, as used in Open Journal Systems OJS, Open Monograph Press OMP, and Open Preprint Systems OPS before versions 3.4.0-4 or 3.3.0-16, suffer from a NativeImportExportPlugin related remote code execution vulnerability...
PKP-WAL 3.4.0-3 Remote Code Execution
--------------------------------------------------------------------------------- PKP-WAL getDeployment; 103. 104. $context = $deployment-getContext; 105. 106. $locale = $node-getAttribute'locale'; 107. if empty$locale 108. $locale = $context-getPrimaryLocale; 109. 110. 111. $coverImagelocale = ;...
CVE-2023-5902
Cross-Site Request Forgery CSRF in GitHub repository pkp/pkp-lib prior to 3.3.0-16...
CVE-2023-5903
Cross-site Scripting XSS - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16...
CVE-2023-5901
Cross-site Scripting in GitHub repository pkp/pkp-lib prior to 3.3.0-16...
CVE-2023-5900
Cross-Site Request Forgery in GitHub repository pkp/pkp-lib prior to 3.3.0-16...
Cross site scripting
Cross-site Scripting in GitHub repository pkp/pkp-lib prior to 3.3.0-16...