CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 07/11/2023 |
| CVE-2023-5901 | 中危4.8 | Cross-site Scripting in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
| 07/11/2023 |
| CVE-2023-5900 | 中危4.3 | Cross-Site Request Forgery in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
| 07/11/2023 |
| CVE-2023-47271 | 中危5.3 | PKP-WAL (aka PKP Web Application Library or pkp-lib) before 3.3.0-16, as used in Open Journal Systems (OJS) and other products, does not verify that the file named in an XML document (used for the native import/export plugin) is an image file, before trying to use it for an issue cover image. | 06/11/2023 |
| CVE-2023-5897 | 高危8.8 | Cross-Site Request Forgery (CSRF) in GitHub repository pkp/customLocale prior to 1.2.0-1. | 01/11/2023 |
| CVE-2023-5896 | 中危5.4 | Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.4.0-4. | 01/11/2023 |
| CVE-2023-5895 | 中危5.4 | Cross-site Scripting (XSS) - DOM in GitHub repository pkp/pkp-lib prior to 3.3.0-16. | 01/11/2023 |
| CVE-2023-5894 | 中危5.4 | Cross-site Scripting (XSS) - Stored in GitHub repository pkp/ojs prior to 3.3.0-16. | 01/11/2023 |
| CVE-2023-5893 | 高危8.8 | Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16. | 01/11/2023 |
| CVE-2023-5892 | 中危5.4 | Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16. | 01/11/2023 |
| CVE-2023-5891 | 中危5.4 | Cross-site Scripting (XSS) - Reflected in GitHub repository pkp/pkp-lib prior to 3.3.0-16. | 01/11/2023 |
| CVE-2023-5890 | 中危5.4 | Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16. | 01/11/2023 |
| CVE-2023-5626 | 高危8.8 | Cross-Site Request Forgery (CSRF) in GitHub repository pkp/ojs prior to 3.3.0-16. | 18/10/2023 |
| CVE-2019-19909 | 高危8.8 | An issue was discovered in Public Knowledge Project (PKP) pkp-lib before 3.1.2-2, as used in Open Journal Systems (OJS) before 3.1.2-2. Code injection can occur in the OJS report generator if an authenticated Journal Manager user visits a crafted URL, because unserialize is used. | 19/12/2019 |
| CVE-2018-12229 | 中危6.1 | Cross-site scripting (XSS) vulnerability in Public Knowledge Project (PKP) Open Journal System (OJS) 3.0.0 to 3.1.1-1 allows remote attackers to inject arbitrary web script or HTML via the templates/frontend/pages/search.tpl parameter (aka the By Author field). | 12/06/2018 |