Pkp
Monthly
PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference (CWE-639) in its subscription management forms, letting an authenticated journal manager or subscription manager read subscriber details belonging to other journals via the editSubscription endpoint and reassign those subscriptions to their own journal via updateSubscription, which revokes the legitimate owners' access. Because subscription identifiers are sequential, the flaw is trivially enumerable, but exploitation requires a privileged account on at least one journal and a multi-journal installation where other journals' subscription records actually exist; single-journal deployments face negligible exposure and there is no public exploit identified at time of analysis.
XML External Entity (XXE) injection in the XSLTransformer component of pkp-lib - the shared PHP library underlying Open Journal Systems, Open Monograph Press, and Open Preprint Systems - allows high-privileged authenticated users to force server-side external entity resolution during XSLT processing, enabling local file disclosure and potential server-side request forgery. Affected branches span all three actively maintained release lines (3.3.x, 3.4.x, 3.5.x) with vendor-released patches confirmed for each. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.
Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Insufficient Session Expiration in GitHub repository pkp/pkp-lib prior to 3.3.0-16. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Use of Predictable Algorithm in Random Number Generator in GitHub repository pkp/pkp-lib prior to 3.3.0-16. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in Open Journal Systems before 2.3.7 allow remote attackers and remote authenticated users to inject arbitrary web script or HTML via the (1). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 33.0%.
Incomplete blacklist vulnerability in Open Journal Systems before 2.3.7 allows remote authenticated users with the Author Role permission to execute arbitrary code by uploading a file with an. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 12.5%.
Multiple directory traversal vulnerabilities in the iBrowser plugin library, as used in Open Journal Systems before 2.3.7, allow remote authenticated users to (1) delete or (2) rename arbitrary files. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference (CWE-639) in its subscription management forms, letting an authenticated journal manager or subscription manager read subscriber details belonging to other journals via the editSubscription endpoint and reassign those subscriptions to their own journal via updateSubscription, which revokes the legitimate owners' access. Because subscription identifiers are sequential, the flaw is trivially enumerable, but exploitation requires a privileged account on at least one journal and a multi-journal installation where other journals' subscription records actually exist; single-journal deployments face negligible exposure and there is no public exploit identified at time of analysis.
XML External Entity (XXE) injection in the XSLTransformer component of pkp-lib - the shared PHP library underlying Open Journal Systems, Open Monograph Press, and Open Preprint Systems - allows high-privileged authenticated users to force server-side external entity resolution during XSLT processing, enabling local file disclosure and potential server-side request forgery. Affected branches span all three actively maintained release lines (3.3.x, 3.4.x, 3.5.x) with vendor-released patches confirmed for each. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.
Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Insufficient Session Expiration in GitHub repository pkp/pkp-lib prior to 3.3.0-16. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Use of Predictable Algorithm in Random Number Generator in GitHub repository pkp/pkp-lib prior to 3.3.0-16. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in Open Journal Systems before 2.3.7 allow remote attackers and remote authenticated users to inject arbitrary web script or HTML via the (1). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 33.0%.
Incomplete blacklist vulnerability in Open Journal Systems before 2.3.7 allows remote authenticated users with the Author Role permission to execute arbitrary code by uploading a file with an. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 12.5%.
Multiple directory traversal vulnerabilities in the iBrowser plugin library, as used in Open Journal Systems before 2.3.7, allow remote authenticated users to (1) delete or (2) rename arbitrary files. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.