CVE-2023-5626

CVE-2023-5626 affects Open Journal Systems (OJS) pkp/ojs versions prior to 3.3.0-16. Root cause is a Cross-Site Request Forgery (CSRF) vulnerability. The impact is described as high in CVSS metrics (C/H, I/H, A/H) for the NVD entry; exploitation may allow unauthorized actions requiring user inter...

CVE-2019-19909

PKP pkp-lib before 3.1.2-2 and OJS before 3.1.2-2 are affected. A crafted URL can trigger code injection in the OJS report generator via unserialize when an authenticated Journal Manager visits it. Remediation: upgrade to pkp-lib 3.1.2-2 or later and OJS 3.1.2-2 or later (or apply vendor-provided...