repository icon
pkp / pkp-lib Project repository

The library used by PKP's applications OJS, OMP and OPS, open source software for scholarly publishing.

Submit a report

FIRST INTERACTION

WITHIN1 DAY

REVIEW

WITHIN3 DAYS

FIX

WITHIN33 DAYS

CSRF in Closed Discussions
hainguyen0207
pending
Store XSS in Select an issue to schedule for publication
hainguyen0207
pending
IDOR - Disable Email Templates (Workflow) without permission
hainguyen0207
spam
Stored XSS - in Title (Journal)
nam-no
spam
Store XSS when Add Reviewer
hainguyen0207
Medium
•$15•CVE-2023-5890
CSRF in Cancel Reviewer and Reinstate Reviewer
hainguyen0207
Low
•$5•CVE-2023-5898
CSRF in Review Details
hainguyen0207
Low
•$5•CVE-2023-5899
Cross-Site Request Forgery (CSRF) in
thanhlam-attt
Medium
•$15•CVE-2023-5902
Store XSS in Delete Announcements
hainguyen0207
pending
No rate limiting on creating new role
thanhlam-attt
not applicable
Stored XSS in function Add discussion at the Copyediting section
thanhlam-attt
Medium
•$15•CVE-2023-5892
CSRF in Participants Assign
hainguyen0207
duplicate
Medium
Store XSS when create roles
hainguyen0207
spam
CSRF Delete Navigation Menu Items
hainguyen0207
Low
•$5•CVE-2023-5900
CSRF Delete Categories
hainguyen0207
Low
•$5•CVE-2023-5893
xss in journal-title executed in publish page
surayp
not applicable
xss in issue-title executed in publish page
surayp
not applicable
stored xss using Section-title when creating submission
ranjit-git
duplicate
High
stored xss using journal-name when creating submission
ranjit-git
duplicate
High
stored xss using svg file upload in "Publisher Library"
ranjit-git
not applicable
stored xss in website section
nyeooo
not applicable
stored xss using journal-role when user try to export user of any journal
ranjit-git
Low
•$5•CVE-2023-5896
Store XSS at Reason for enabling user
hainguyen0207
not applicable
Disabled accounts still work normally
hainguyen0207
Medium
•$15•CVE-2023-5889
STORED XSS in Journal-> Sections
nyeooo
Low
•$5•CVE-2023-5903
Stored XSS in Distribution Setting
nyeooo
spam
Stored xss using journal role-name
ranjit-git
informative
Low
Stored xss using journal-name
ranjit-git
Medium
•$15•CVE-2023-5891
Stored xss using journal-name in journal-tab
ranjit-git
Low
•$5•CVE-2023-5904
Stored XSS in module named "New Submissions"
trunggg02
Low
•$5•CVE-2023-5895
Stored xss in function upload file "HomePage"
trunggg02
duplicate
High
Cross-Site Scripting ( XSS) Via file upload
trunggg02
Low
•$5•CVE-2023-5901
Use of predictable RNG for password generation
michaellrowley
Critical
•$75•CVE-2023-4695
Failure to invalidate session after password change
novemberdad
spam
jQuery-form is potential vulnerable to XSS
popcorn94
self closed
Cross-Site Request Forgery (CSRF)
haxatron
Medium
•$40
Cross-Site Request Forgery (CSRF)
haxatron
High
•$50
Cross-Site Request Forgery (CSRF)
haxatron
Medium
•$75