Vendor
pkp
22 known vulnerabilities.
pkp at a glance
- Last 12 months
- 3
- Critical · all time
- 1
- Exploited · all time
- 0
- Public exploit · all time
- 0
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 1 | 0 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 2 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
22 results · Feed
-
Low 3.8
PKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via updateSubscription
PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequentia…
-
Medium 4.7
pkp pkp-lib XSLTransformer.php _transformPHP xml external entity reference
A vulnerability was detected in pkp pkp-lib up to 3.3.0-22/3.4.0-10/3.5.0-4. The affected element is the function _transformPHP of the file classes/xslt/XSLTransformer.php. The manipulation results in xml external entity reference. The attack can be executed …
-
Low 3.7
pkp pkp-lib API Key Generation APIProfileForm.php setData entropy
A weakness has been identified in pkp pkp-lib 3.3.0/3.4.0/3.5.0. This vulnerability affects the function setData of the file classes/user/form/APIProfileForm.php of the component API Key Generation. Executing a manipulation of the argument apiKey can lead to …
-
Medium 4.3
pkp ojs signOut redirect
A vulnerability was found in pkp ojs up to 3.4.0-6 and classified as problematic. Affected by this issue is some unknown functionality of the file /login/signOut. The manipulation of the argument source with the input .example.com leads to open redirect. The …
-
Low 2.7
Cross-site Scripting (XSS) - Stored in pkp/pkp-lib
Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
-
Low 3.5
Cross-site Scripting in pkp/pkp-lib
Cross-site Scripting in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
-
Low 3.5
Cross-Site Request Forgery in pkp/pkp-lib
Cross-Site Request Forgery in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
-
Low 2.7
Cross-site Scripting (XSS) - Stored in pkp/pkp-lib
Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
-
Medium 6.3
Cross-Site Request Forgery (CSRF) in pkp/customLocale
Cross-Site Request Forgery (CSRF) in GitHub repository pkp/customLocale prior to 1.2.0-1.
-
Low 3.5
Cross-Site Request Forgery (CSRF) in pkp/pkp-lib
Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
-
Low 3.5
Cross-Site Request Forgery (CSRF) in pkp/pkp-lib
Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
-
Medium 4.3
Cross-Site Request Forgery (CSRF) in pkp/pkp-lib
Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
-
Low 2.7
Cross-site Scripting (XSS) - Stored in pkp/pkp-lib
Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.4.0-4.
-
Low 3.5
Cross-site Scripting (XSS) - DOM in pkp/pkp-lib
Cross-site Scripting (XSS) - DOM in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
-
Medium 5.4
Cross-site Scripting (XSS) - Stored in pkp/pkp-lib
Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
-
Medium 4.6
Cross-site Scripting (XSS) - Stored in pkp/pkp-lib
Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
-
Low 3.5
Cross-site Scripting (XSS) - Stored in pkp/ojs
Cross-site Scripting (XSS) - Stored in GitHub repository pkp/ojs prior to 3.3.0-16.
-
Medium 4.3
Insufficient Session Expiration in pkp/pkp-lib
Insufficient Session Expiration in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
-
Low 3.5
Cross-Site Request Forgery (CSRF) in pkp/pkp-lib
Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
-
Medium 5.4
Cross-site Scripting (XSS) - Reflected in pkp/pkp-lib
Cross-site Scripting (XSS) - Reflected in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
-
Low 3.5
Cross-Site Request Forgery (CSRF) in pkp/ojs
Cross-Site Request Forgery (CSRF) in GitHub repository pkp/ojs prior to 3.3.0-16.
-
Critical 9.6
Use of Predictable Algorithm in Random Number Generator in pkp/pkp-lib
Use of Predictable Algorithm in Random Number Generator in GitHub repository pkp/pkp-lib prior to 3.3.0-16.