CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 07/11/2023 |
| CVE-2023-5901 | MEDIUM4.8 | Cross-site Scripting in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
| 07/11/2023 |
| CVE-2023-5900 | MEDIUM4.3 | Cross-Site Request Forgery in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
| 07/11/2023 |
| CVE-2023-47271 | MEDIUM5.3 | PKP-WAL (aka PKP Web Application Library or pkp-lib) before 3.3.0-16, as used in Open Journal Systems (OJS) and other products, does not verify that the file named in an XML document (used for the native import/export plugin) is an image file, before trying to use it for an issue cover image. | 06/11/2023 |
| CVE-2023-5897 | HIGH8.8 | Cross-Site Request Forgery (CSRF) in GitHub repository pkp/customLocale prior to 1.2.0-1. | 01/11/2023 |
| CVE-2023-5896 | MEDIUM5.4 | Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.4.0-4. | 01/11/2023 |
| CVE-2023-5895 | MEDIUM5.4 | Cross-site Scripting (XSS) - DOM in GitHub repository pkp/pkp-lib prior to 3.3.0-16. | 01/11/2023 |
| CVE-2023-5894 | MEDIUM5.4 | Cross-site Scripting (XSS) - Stored in GitHub repository pkp/ojs prior to 3.3.0-16. | 01/11/2023 |
| CVE-2023-5893 | HIGH8.8 | Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16. | 01/11/2023 |
| CVE-2023-5892 | MEDIUM5.4 | Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16. | 01/11/2023 |
| CVE-2023-5891 | MEDIUM5.4 | Cross-site Scripting (XSS) - Reflected in GitHub repository pkp/pkp-lib prior to 3.3.0-16. | 01/11/2023 |
| CVE-2023-5890 | MEDIUM5.4 | Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16. | 01/11/2023 |
| CVE-2023-5626 | HIGH8.8 | Cross-Site Request Forgery (CSRF) in GitHub repository pkp/ojs prior to 3.3.0-16. | 18/10/2023 |
| CVE-2019-19909 | HIGH8.8 | An issue was discovered in Public Knowledge Project (PKP) pkp-lib before 3.1.2-2, as used in Open Journal Systems (OJS) before 3.1.2-2. Code injection can occur in the OJS report generator if an authenticated Journal Manager user visits a crafted URL, because unserialize is used. | 19/12/2019 |
| CVE-2018-12229 | MEDIUM6.1 | Cross-site scripting (XSS) vulnerability in Public Knowledge Project (PKP) Open Journal System (OJS) 3.0.0 to 3.1.1-1 allows remote attackers to inject arbitrary web script or HTML via the templates/frontend/pages/search.tpl parameter (aka the By Author field). | 12/06/2018 |