A cross-site scripting (XSS) vulnerability in the Submission module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Input subject field under the Add Discussion function.
Max CVSS
N/A
EPSS Score
0.04%
Published
2024-03-01
Updated
2024-03-04
A cross-site scripting (XSS) vulnerability in the Production module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Input subject field under the Add Discussion function.
Max CVSS
N/A
EPSS Score
0.04%
Published
2024-03-01
Updated
2024-03-04
A cross-site scripting (XSS) vulnerability in Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Publicname parameter.
Max CVSS
N/A
EPSS Score
0.04%
Published
2024-03-01
Updated
2024-03-04
Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the input subtitle component.
Max CVSS
N/A
EPSS Score
0.04%
Published
2024-03-01
Updated
2024-03-04
Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the Input Title component.
Max CVSS
N/A
EPSS Score
0.04%
Published
2024-03-01
Updated
2024-03-04
Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
Max CVSS
8.8
EPSS Score
0.06%
Published
2023-11-01
Updated
2023-11-08
Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
Max CVSS
8.8
EPSS Score
0.06%
Published
2023-11-01
Updated
2023-11-08
Insufficient Session Expiration in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
Max CVSS
8.2
EPSS Score
0.08%
Published
2023-11-01
Updated
2023-11-09
Use of Predictable Algorithm in Random Number Generator in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
Max CVSS
9.6
EPSS Score
0.11%
Published
2023-09-01
Updated
2023-09-07
Multiple cross-site scripting (XSS) vulnerabilities in Open Journal Systems before 2.3.7 allow remote attackers and remote authenticated users to inject arbitrary web script or HTML via the (1) editor or (2) callback parameters to lib/pkp/lib/tinymce/jscripts/tiny_mce/plugins/ibrowser/ibrowser.php in the iBrowser plugin, (3) authors[][url] parameter to index.php, or (4) Bio Statement or (5) Abstract of Submission fields to the stripUnsafeHtml function in lib/pkp/classes/core/String.inc.php.
Max CVSS
4.3
EPSS Score
0.96%
Published
2012-09-06
Updated
2018-01-12
Incomplete blacklist vulnerability in Open Journal Systems before 2.3.7 allows remote authenticated users with the Author Role permission to execute arbitrary code by uploading a file with an executable extension that is not ".php", then accessing it via a direct request to the file in submission/original/ in the associated article directory, as demonstrated using .pHp, .asp, and other extensions.
Max CVSS
6.0
EPSS Score
0.57%
Published
2012-09-06
Updated
2012-09-07
Multiple directory traversal vulnerabilities in the iBrowser plugin library, as used in Open Journal Systems before 2.3.7, allow remote authenticated users to (1) delete or (2) rename arbitrary files via a .. (dot dot) in the param parameter to lib/pkp/lib/tinymce/jscripts/tiny_mce/plugins/ibrowser/scripts/rfiles.php.
Max CVSS
6.5
EPSS Score
0.39%
Published
2012-09-06
Updated
2012-09-13
12 vulnerabilities found
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!