CVE-2012-1469

Multiple cross-site scripting (XSS) vulnerabilities in Open Journal Systems
before 2.3.7 allow remote attackers and remote authenticated users to
inject arbitrary web script or HTML via the (1) editor or (2) callback
parameters to
lib/pkp/lib/tinymce/jscripts/tiny_mce/plugins/ibrowser/ibrowser.php in the
iBrowser plugin, (3) authors[][url] parameter to index.php, or (4) Bio
Statement or (5) Abstract of Submission fields to the stripUnsafeHtml
function in lib/pkp/classes/core/String.inc.php.