PKP-WAL (aka PKP Web Application Library or pkp-lib) before 3.3.0-16, as used in Open Journal Systems (OJS) and other products, does not verify that the file named in an XML document (used for the native import/export plugin) is an image file, before trying to use it for an issue cover image.
5.3CVSS
5.2AI Score
0.001EPSS
Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
5.4CVSS
4.8AI Score
0.0004EPSS
Cross-site Scripting (XSS) - Reflected in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
5.4CVSS
5.3AI Score
0.0004EPSS
Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
5.4CVSS
5.3AI Score
0.0004EPSS
Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
8.8CVSS
5.4AI Score
0.001EPSS
Cross-site Scripting (XSS) - DOM in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
5.4CVSS
4.3AI Score
0.0004EPSS
Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.4.0-4.
5.4CVSS
4.2AI Score
0.0004EPSS
4.3CVSS
4.7AI Score
0.0005EPSS
4.8CVSS
5AI Score
0.0004EPSS
Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
4.3CVSS
4.7AI Score
0.0005EPSS
Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
5.4CVSS
4.2AI Score
0.0004EPSS
Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
5.4CVSS
4.2AI Score
0.0004EPSS