Skip to content
OpenAdvisories

Vendor

pkp

22 known vulnerabilities.

Products

pkp/pkp-lib 15 pkp/ojs 2 pkp-lib 2 ojs 1 Open Journal Systems 1 pkp/customLocale 1
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Low 3.8
    CVE-2026-111609

    PKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via updateSubscription

    PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequentia…

    pkp Open Journal Systems
  • Low 3.7
    CVE-2026-19906

    pkp pkp-lib API Key Generation APIProfileForm.php setData entropy

    A weakness has been identified in pkp pkp-lib 3.3.0/3.4.0/3.5.0. This vulnerability affects the function setData of the file classes/user/form/APIProfileForm.php of the component API Key Generation. Executing a manipulation of the argument apiKey can lead to …

    pkp pkp-lib
  • Low 2.7
    CVE-2023-5904

    Cross-site Scripting (XSS) - Stored in pkp/pkp-lib

    Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

    pkp pkp/pkp-lib
  • Low 3.5
    CVE-2023-5901

    Cross-site Scripting in pkp/pkp-lib

    Cross-site Scripting in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

    pkp pkp/pkp-lib
  • Low 3.5
    CVE-2023-5900

    Cross-Site Request Forgery in pkp/pkp-lib

    Cross-Site Request Forgery in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

    pkp pkp/pkp-lib
  • Low 2.7
    CVE-2023-5903

    Cross-site Scripting (XSS) - Stored in pkp/pkp-lib

    Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

    pkp pkp/pkp-lib
  • Low 3.5
    CVE-2023-5899

    Cross-Site Request Forgery (CSRF) in pkp/pkp-lib

    Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

    pkp pkp/pkp-lib
  • Low 3.5
    CVE-2023-5898

    Cross-Site Request Forgery (CSRF) in pkp/pkp-lib

    Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

    pkp pkp/pkp-lib
  • Low 2.7
    CVE-2023-5896

    Cross-site Scripting (XSS) - Stored in pkp/pkp-lib

    Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.4.0-4.

    pkp pkp/pkp-lib
  • Low 3.5
    CVE-2023-5895

    Cross-site Scripting (XSS) - DOM in pkp/pkp-lib

    Cross-site Scripting (XSS) - DOM in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

    pkp pkp/pkp-lib
  • Low 3.5
    CVE-2023-5894

    Cross-site Scripting (XSS) - Stored in pkp/ojs

    Cross-site Scripting (XSS) - Stored in GitHub repository pkp/ojs prior to 3.3.0-16.

    pkp pkp/ojs
  • Low 3.5
    CVE-2023-5893

    Cross-Site Request Forgery (CSRF) in pkp/pkp-lib

    Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

    pkp pkp/pkp-lib
  • Low 3.5
    CVE-2023-5626

    Cross-Site Request Forgery (CSRF) in pkp/ojs

    Cross-Site Request Forgery (CSRF) in GitHub repository pkp/ojs prior to 3.3.0-16.

    pkp pkp/ojs