Vulnerabilities

TI-2026-75395 CVE-2026-111609 · GHSA-rwgq-cgw6-3p37

PKP Open Journal Systems exposes other journals' subscriptions

MEDIUM 56

PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription…

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00303 Published 2026-10-16 No fix listed CWE-639

TI-2026-53513 CVE-2026-76572 · GHSA-8j8f-r97j-fp5x

pkp pkp-lib XSLTransformer.php _transformPHP xml external entity reference

LOW 24

A vulnerability was detected in pkp pkp-lib up to 3.3.0-22/3.4.0-10/3.5.0-4.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00454 Published 2026-08-19 Fixed in 3.3.0-23, 3.4.0-11 +1 CWE-610

TI-2026-16139 CVE-2026-19906 · GHSA-gccx-9qmf-hrf5

pkp pkp-lib API Key Generation APIProfileForm.php setData entropy

LOW 29

A weakness has been identified in pkp pkp-lib 3.3.0/3.4.0/3.5.0.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00493 Published 2026-08-15 No fix listed CWE-330

TI-2024-07324 CVE-2024-7902 · GHSA-7q9g-rf94-v7cw

pkp ojs signOut redirect

LOW 31

A vulnerability was found in pkp ojs up to 3.4.0-6 and classified as problematic.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00437 Published 2024-08-17 No fix listed CWE-601

TI-2023-05436 CVE-2023-5904 · GHSA-q675-425f-q77p

Cross-site Scripting (XSS) - Stored in pkp/pkp-lib

MEDIUM 58

Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00514 Published 2023-11-01 Fixed in 3.3.0-16 CWE-79

TI-2023-05435 CVE-2023-5903 · GHSA-86g4-v35q-p7r3

Cross-site Scripting (XSS) - Stored in pkp/pkp-lib

MEDIUM 58

Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00514 Published 2023-11-01 Fixed in 3.3.0-16 CWE-79

TI-2023-05432 CVE-2023-5900 · GHSA-5w9x-5g27-3wqv

Cross-Site Request Forgery in pkp/pkp-lib

MEDIUM 53

Cross-Site Request Forgery in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00272 Published 2023-11-01 Fixed in 3.3.0-16 CWE-352

TI-2023-05433 CVE-2023-5901 · GHSA-v93c-j63p-5mqw

Cross-site Scripting in pkp/pkp-lib

LOW 23

Cross-site Scripting in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00527 Published 2023-11-01 Fixed in 3.3.0-16 CWE-79

TI-2023-05429 CVE-2023-5897 · GHSA-h6c7-v3fj-vggf

Cross-Site Request Forgery (CSRF) in pkp/customLocale

HIGH 71

Cross-Site Request Forgery (CSRF) in GitHub repository pkp/customLocale prior to 1.2.0-1.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00247 Published 2023-11-01 Fixed in 1.2.0-1 CWE-352

TI-2023-05430 CVE-2023-5898 · GHSA-3jhg-jx8m-q62v

Cross-Site Request Forgery (CSRF) in pkp/pkp-lib

HIGH 71

Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00302 Published 2023-11-01 Fixed in 3.3.0-16 CWE-352

TI-2023-05434 CVE-2023-5902

Cross-Site Request Forgery (CSRF) in pkp/pkp-lib

MEDIUM 53

Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00289 Published 2023-11-01 Fixed in 3.3.0-16 CWE-352

TI-2023-05428 CVE-2023-5896 · GHSA-m6g2-339q-45j8

Cross-site Scripting (XSS) - Stored in pkp/pkp-lib

MEDIUM 58

Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.4.0-4.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0039 Published 2023-11-01 Fixed in 3.4.0-4 CWE-79

TI-2023-05431 CVE-2023-5899 · GHSA-7592-7873-rfj4

Cross-Site Request Forgery (CSRF) in pkp/pkp-lib

HIGH 71

Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00302 Published 2023-11-01 Fixed in 3.3.0-16 CWE-352

TI-2023-05427 CVE-2023-5895 · GHSA-r23r-h529-fcxw

Cross-site Scripting (XSS) - DOM in pkp/pkp-lib

MEDIUM 58

Cross-site Scripting (XSS) - DOM in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00475 Published 2023-11-01 Fixed in 3.3.0-16 CWE-79

TI-2023-05426 CVE-2023-5894 · GHSA-7j74-mjgh-q8hf

Cross-site Scripting (XSS) - Stored in pkp/ojs

MEDIUM 58

Cross-site Scripting (XSS) - Stored in GitHub repository pkp/ojs prior to 3.3.0-16.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00463 Published 2023-11-01 Fixed in 3.3.0-16 CWE-79

TI-2023-05421 CVE-2023-5889 · GHSA-c2hr-fwvr-rxjm

Insufficient Session Expiration in pkp/pkp-lib

LOW 36

Insufficient Session Expiration in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00518 Published 2023-11-01 Fixed in 3.3.0-16 CWE-613

TI-2023-05423 CVE-2023-5891 · GHSA-rhhg-49v7-xmqc

Cross-site Scripting (XSS) - Reflected in pkp/pkp-lib

MEDIUM 58

Cross-site Scripting (XSS) - Reflected in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00467 Published 2023-11-01 Fixed in 3.3.0-16 CWE-79

TI-2023-05424 CVE-2023-5892 · GHSA-9vrm-5j5h-x98j

Cross-site Scripting (XSS) - Stored in pkp/pkp-lib

MEDIUM 58

Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00467 Published 2023-11-01 Fixed in 3.3.0-16 CWE-79

TI-2023-05425 CVE-2023-5893 · GHSA-g7x3-4v2w-9vxw

Cross-Site Request Forgery (CSRF) in pkp/pkp-lib

HIGH 71

Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00302 Published 2023-11-01 Fixed in 3.3.0-16 CWE-352

TI-2023-05422 CVE-2023-5890 · GHSA-c368-3rx3-26ww

Cross-site Scripting (XSS) - Stored in pkp/pkp-lib

MEDIUM 58

Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00467 Published 2023-11-01 Fixed in 3.3.0-16 CWE-79

TI-2023-05178 CVE-2023-5626 · GHSA-9m4v-rfw4-5c96

Cross-Site Request Forgery (CSRF) in pkp/ojs

HIGH 71

Cross-Site Request Forgery (CSRF) in GitHub repository pkp/ojs prior to 3.3.0-16.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00302 Published 2023-10-17 Fixed in 3.3.0-16 CWE-352

TI-2023-04327 CVE-2023-4695 · GHSA-26cf-ch3x-rfxg

Use of Predictable Algorithm in Random Number Generator in pkp/pkp-lib

HIGH 70

Use of Predictable Algorithm in Random Number Generator in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00724 Published 2023-09-01 Fixed in 3.3.0-16 CWE-1241

TI-2012-01291 CVE-2012-1469 · GHSA-xgvf-fhwg-5w43

Multiple cross-site scripting (XSS) vulnerabilities in Open Journal Systems before 2.3.7…

LOW 26

Multiple cross-site scripting (XSS) vulnerabilities in Open Journal Systems before 2.3.7 allow remote attackers and remote authenticated users to inject arbitrary web script or HTML via the (1) editor or (2) callback par…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.03077 Published 2012-09-06 No fix listed CWE-79

TI-2012-01290 CVE-2012-1468 · GHSA-hv36-f2fr-5259

Incomplete blacklist vulnerability in Open Journal Systems before 2.3.7 allows remote…

LOW 33

Incomplete blacklist vulnerability in Open Journal Systems before 2.3.7 allows remote authenticated users with the Author Role permission to execute arbitrary code by uploading a file with an executable extension that is…

CVSS 2.0MEDIUM 6.0 Network Low privileges Interaction — EPSS 0.03482 Published 2012-09-06 No fix listed

TI-2012-01289 CVE-2012-1467 · GHSA-89f7-hp3x-wrxg

Multiple directory traversal vulnerabilities in the iBrowser plugin library, as used in…

LOW 34

Multiple directory traversal vulnerabilities in the iBrowser plugin library, as used in Open Journal Systems before 2.3.7, allow remote authenticated users to (1) delete or (2) rename arbitrary files via a ..

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.03003 Published 2012-09-06 No fix listed CWE-22

Vulnerabilities

Filters