Pkp

Open Journal Systems

7 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.1

CVE-2024-24511

Exploit
  • EPSS 0.23%
  • Veröffentlicht 01.03.2024 23:15:08
  • Zuletzt bearbeitet 18.04.2025 14:03:24

Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the Input Title component.

6.1

CVE-2024-24512

Exploit
  • EPSS 0.23%
  • Veröffentlicht 01.03.2024 23:15:08
  • Zuletzt bearbeitet 18.04.2025 14:00:48

Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the input subtitle component.

5.4

CVE-2024-25434

Exploit
  • EPSS 0.12%
  • Veröffentlicht 01.03.2024 23:15:08
  • Zuletzt bearbeitet 16.04.2025 18:28:49

A cross-site scripting (XSS) vulnerability in Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Publicname parameter.

6.1

CVE-2024-25438

Exploit
  • EPSS 0.16%
  • Veröffentlicht 01.03.2024 23:15:08
  • Zuletzt bearbeitet 15.05.2025 21:10:40

A cross-site scripting (XSS) vulnerability in the Submission module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Input subject field under the Add Discussion function.

6.5

CVE-2012-1467

Exploit
  • EPSS 2.47%
  • Veröffentlicht 06.09.2012 21:55:01
  • Zuletzt bearbeitet 11.04.2025 00:51:21

Multiple directory traversal vulnerabilities in the iBrowser plugin library, as used in Open Journal Systems before 2.3.7, allow remote authenticated users to (1) delete or (2) rename arbitrary files via a .. (dot dot) in the param parameter to lib/p...

6

CVE-2012-1468

Exploit
  • EPSS 4.46%
  • Veröffentlicht 06.09.2012 21:55:01
  • Zuletzt bearbeitet 11.04.2025 00:51:21

Incomplete blacklist vulnerability in Open Journal Systems before 2.3.7 allows remote authenticated users with the Author Role permission to execute arbitrary code by uploading a file with an executable extension that is not ".php", then accessing it...

4.3

CVE-2012-1469

Exploit
  • EPSS 16.27%
  • Veröffentlicht 06.09.2012 21:55:01
  • Zuletzt bearbeitet 11.04.2025 00:51:21

Multiple cross-site scripting (XSS) vulnerabilities in Open Journal Systems before 2.3.7 allow remote attackers and remote authenticated users to inject arbitrary web script or HTML via the (1) editor or (2) callback parameters to lib/pkp/lib/tinymce...