CVE-2023-5896

CVE-2023-5896 is a stored XSS vulnerability in PKP's pkp-lib repository, affecting versions prior to 3.4.0-4. Impact is typical web:XSS with user export workflows (e.g., exporting journal users) as described in sources. Affected component: pkp/pkp-lib; root cause: stored XSS when exporting user d...

CVE-2023-47271

PKP-WAL (pkp-lib) before 3.3.0-16, used in OJS and related products, fails to verify that a file named in an XML document (Native Import/Export plugin) is an image before using it as an issue cover image. The issue stems from PKPNativeFilterHelper::parsePublicationCover() in the NativeImportExpor...

CVE-2023-5891

CVE-2023-5891 is a Cross-site Scripting (XSS) vulnerability in PKP Web Application Library (PKP-lib) prior to version 3.3.0-16. The issue arises from unescaped user input in web responses, enabling reflected XSS attacks in the pkp/pkp-lib component. Affected software is PKP Web Application Librar...

CVE-2023-5893

The CVE-2023-5893 issue affects pkp/pkp-lib versions prior to 3.3.0-16 and is a Cross-Site Request Forgery (CSRF) vulnerability. The PEP/PoC materials indicate CSRF can enable unauthorized state-changing actions on behalf of authenticated users. Public details confirm the vulnerable component is ...

CVE-2023-5901

PKP-pkp-lib prior to version 3.3.0-16 is affected by a Cross-site Scripting (XSS) vulnerability. The issue originates from Unrestricted Upload of a file with dangerous type, enabling script execution via uploaded content in the PKP Web Application Library used by PKP projects (OJS/OCS/OMP/OPS/OHS...

CVE-2023-5895

CVE-2023-5895 affects the PKP library (pkp/pkp-lib) prior to 3.3.0-16, with a DOM-based Cross-site Scripting (XSS) flaw caused by unescaped user input in the web output. Public references in Red Hat and OSV/NVD confirm the issue as XSS in pkp/pkp-lib, tracked across multiple sources. The vulnerab...

CVE-2023-5890

CVE-2023-5890 affects pkp/pkp-lib (PKP Web Application Library) prior to version 3.3.0-16. The issue is a Stored Cross-site Scripting (XSS) vulnerability arising from unescaped input in the repository, leading to script injection in impacted sites. The public references consistently describe the ...

CVE-2023-5902

CVE-2023-5902 is a Cross-Site Request Forgery in the PKP Web Application Library (pkp-lib) prior to 3.3.0-16. Affected component: pkp-lib; vulnerable version range:

CVE-2023-5892

CVE-2023-5892 affects PKP Web Application Library (pkp-lib) prior to 3.3.0-16, where input is stored and not escaped, enabling stored XSS in PKP-based systems (e.g., PKP lib used by OJS/OCS/etc.). Root cause: insufficient escaping of stored user input in relevant components of pkp-lib. Impact: cr...

CVE-2023-5904

CVE-2023-5904 describes a stored cross-site scripting (XSS) vulnerability in the PKP Web Application Library (pkp-lib) prior to version 3.3.0-16. The issue affects the handling of journal-name data and can lead to script execution in a victim’s browser. Affected software: pkp-lib prior to 3.3.0-1...

CVE-2023-5900

CVE-2023-5900 is a Cross-Site Request Forgery vulnerability in the PKP Web Application Library used by PKP projects (OJS/OCS/OMP/OPS/OHS). The flaw affects versions prior to 3.3.0-16 and arises from a lack of CSRF authorization checking in the affected library. Public references describe the issu...

CVE-2023-5903

CVE-2023-5903 is a stored XSS vulnerability in the PKP Web Application Library (pkp-lib) affecting versions before 3.3.0-16. The issue exists in pkp/pkp-lib and stems from insecure handling of stored input (XSS). Public sources consistently state the vulnerable version range as prior to 3.3.0-16....