Show filters
13 Total Results
Displaying 1-10 of 13
Sort by:
Attacker Value
Unknown
CVE-2024-7902
Disclosure Date: August 17, 2024 (last updated August 21, 2024)
A vulnerability was found in pkp ojs up to 3.4.0-6 and classified as problematic. Affected by this issue is some unknown functionality of the file /login/signOut. The manipulation of the argument source with the input .example.com leads to open redirect. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
0
Attacker Value
Unknown
CVE-2024-25436
Disclosure Date: March 01, 2024 (last updated January 17, 2025)
A cross-site scripting (XSS) vulnerability in the Production module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Input subject field under the Add Discussion function.
0
Attacker Value
Unknown
CVE-2023-6671
Disclosure Date: December 11, 2023 (last updated December 14, 2023)
A vulnerability has been discovered on OJS, that consists in a CSRF (Cross-Site Request Forgery) attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated.
0
Attacker Value
Unknown
CVE-2023-5894
Disclosure Date: November 01, 2023 (last updated November 09, 2023)
Cross-site Scripting (XSS) - Stored in GitHub repository pkp/ojs prior to 3.3.0-16.
0
Attacker Value
Unknown
CVE-2023-5626
Disclosure Date: October 18, 2023 (last updated October 25, 2023)
Cross-Site Request Forgery (CSRF) in GitHub repository pkp/ojs prior to 3.3.0-16.
0
Attacker Value
Unknown
CVE-2022-26616
Disclosure Date: April 04, 2022 (last updated February 23, 2025)
PKP Vendor Open Journal System v2.4.8 to v3.3.8 allows attackers to perform reflected cross-site scripting (XSS) attacks via crafted HTTP headers.
0
Attacker Value
Unknown
CVE-2022-24181
Disclosure Date: April 01, 2022 (last updated February 23, 2025)
Cross-site scripting (XSS) via Host Header injection in PKP Open Journals System 2.4.8 >= 3.3 allows remote attackers to inject arbitary code via the X-Forwarded-Host Header.
0
Attacker Value
Unknown
CVE-2019-19909
Disclosure Date: December 19, 2019 (last updated November 27, 2024)
An issue was discovered in Public Knowledge Project (PKP) pkp-lib before 3.1.2-2, as used in Open Journal Systems (OJS) before 3.1.2-2. Code injection can occur in the OJS report generator if an authenticated Journal Manager user visits a crafted URL, because unserialize is used.
0
Attacker Value
Unknown
CVE-2018-12229
Disclosure Date: June 12, 2018 (last updated November 26, 2024)
Cross-site scripting (XSS) vulnerability in Public Knowledge Project (PKP) Open Journal System (OJS) 3.0.0 to 3.1.1-1 allows remote attackers to inject arbitrary web script or HTML via the templates/frontend/pages/search.tpl parameter (aka the By Author field).
0
Attacker Value
Unknown
CVE-2011-5196
Disclosure Date: September 23, 2012 (last updated October 05, 2023)
Cross-site request forgery (CSRF) vulnerability in index/manager/fileUpload in Public Knowledge Project Open Journal Systems 2.3.6 and earlier allows remote attackers to hijack the authentication of administrators for requests that upload PHP files.
0
