Open Journal System

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:sfu:open_journal_system:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorSfu (3a958221-7be8-51fc-8453-51bf9e734c75)
ProductOpen Journal System (1148c242-eeb6-5924-8a95-1f60632928b2)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:github/pkp/ojs purl2cpe 2026-06-01 10:11:19.079066

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2023-5626 vulnerable 2026-06-08 06:19:44.193454 Cross-Site Request Forgery (CSRF) in pkp/ojs
LOW (3.5)
Cross-Site Request Forgery (CSRF) in GitHub repository pkp/ojs prior to 3.3.0-16.
Published: 2023-10-17T23:22:41.615Z
Updated: 2024-09-13T16:20:28.980Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-19909 vulnerable 2026-06-08 05:13:23.993635 Details available
An issue was discovered in Public Knowledge Project (PKP) pkp-lib before 3.1.2-2, as used in Open Journal Systems (OJS) before 3.1.2-2. Code injection can occur in the OJS report generator if an authenticated Journal Manager user visits a crafted URL, because unserialize is used.
Published: 2019-12-19T18:07:29.000Z
Updated: 2024-08-05T02:32:09.620Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2018-12229 vulnerable 2026-06-08 05:10:41.267164 Details available
Cross-site scripting (XSS) vulnerability in Public Knowledge Project (PKP) Open Journal System (OJS) 3.0.0 to 3.1.1-1 allows remote attackers to inject arbitrary web script or HTML via the templates/frontend/pages/search.tpl parameter (aka the By Author field).
Published: 2018-06-12T11:00:00.000Z
Updated: 2024-08-05T08:30:59.870Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.