CVE-2022-24181

PKP Open Journal Systems 2.4.8–3.3 is affected by a Cross‑Site Scripting (XSS) vulnerability via the X-Forwarded-Host header (Host Header injection). The underlying issue is header-based input that enables arbitrary script injection into rendered pages, potentially leading to data theft or deface...

CVE-2022-26616

CVE-2022-26616 affects PKP Vendor Open Journal System versions 2.4.8 through 3.3.8. The vulnerability is a reflected cross-site scripting (XSS) flaw exploitable via crafted HTTP headers, allowing an attacker to inject script that is reflected in the user’s response. Connected sources (Red Hat, NV...

CVE-2024-7902

CVE-2024-7902 affects PKP Open Journal Systems (OJS) up to version 3.4.0-6. The vulnerability is in the /login/signOut handler where the input value of the parameter source can be manipulated to produce an open redirect. This can be exploited remotely and the exploit has been disclosed publicly. ...

CVE-2024-25438

CVE-2024-25438 describes a cross-site scripting (XSS) vulnerability in the Submission module of PKP Open Journal Systems (PKP OJS) version 3.3. The issue allows an attacker to inject arbitrary web scripts or HTML via a crafted payload in the Input subject field under the Add Discussion function. ...

CVE-2011-5196

The CVE-2011-5196 entry concerns Public Knowledge Project Open Journal Systems (OJS) prior to version 2.3.6, with a CSRF flaw in the index/manager/fileUpload path. The underlying issue allows an attacker to hijack an administrator’s session and perform requests that upload PHP files. The document...