CVE-2022-24181

PKP Open Journal Systems 2.4.8–3.3 is affected by a Cross‑Site Scripting (XSS) vulnerability via the X-Forwarded-Host header (Host Header injection). The underlying issue is header-based input that enables arbitrary script injection into rendered pages, potentially leading to data theft or deface...

CVE-2022-26616

CVE-2022-26616 affects PKP Vendor Open Journal System versions 2.4.8 through 3.3.8. The vulnerability is a reflected cross-site scripting (XSS) flaw exploitable via crafted HTTP headers, allowing an attacker to inject script that is reflected in the user’s response. Connected sources (Red Hat, NV...

CVE-2024-7902

CVE-2024-7902 affects PKP Open Journal Systems (OJS) up to version 3.4.0-6. The vulnerability is in the /login/signOut handler where the input value of the parameter source can be manipulated to produce an open redirect. This can be exploited remotely and the exploit has been disclosed publicly. ...

CVE-2024-25438

A cross-site scripting (XSS) vulnerability exists in the Submission module of Pkp Ojs v3.3 . Attackers can execute arbitrary web scripts or HTML by injecting a crafted payload into the Input subject field within the Add Discussion function. Practical consequences include the execution of maliciou...

CVE-2011-5196

The CVE-2011-5196 entry concerns Public Knowledge Project Open Journal Systems (OJS) prior to version 2.3.6, with a CSRF flaw in the index/manager/fileUpload path. The underlying issue allows an attacker to hijack an administrator’s session and perform requests that upload PHP files. The document...