pkp vulnerabilities

CVEs per yearBy the year they were published

1. 202318
2. 20241
3. 20263

Newest CVEs

• CVE-2026-111609

  PKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via updateSubscription

  PKP · Open Journal Systems

  Medium5.1
• CVE-2026-76572

  pkp pkp-lib XSLTransformer.php _transformPHP xml external entity reference

  pkp · pkp-lib

  Medium5.1
• CVE-2026-19906

  pkp pkp-lib API Key Generation APIProfileForm.php setData entropy

  pkp · pkp-lib

  Medium6.3
• CVE-2024-7902

  pkp ojs signOut redirect

  pkp · ojs

  Medium6.9
• CVE-2023-5904

  Cross-site Scripting (XSS) - Stored in pkp/pkp-lib

  pkp · pkp/pkp-lib

  Low2.7
• CVE-2023-5903

  Cross-site Scripting (XSS) - Stored in pkp/pkp-lib

  pkp · pkp/pkp-lib

  Low2.7
• CVE-2023-5900

  Cross-Site Request Forgery in pkp/pkp-lib

  pkp · pkp/pkp-lib

  Low3.5
• CVE-2023-5901

  Cross-site Scripting in pkp/pkp-lib

  pkp · pkp/pkp-lib

  Low3.5
• CVE-2023-5897

  Cross-Site Request Forgery (CSRF) in pkp/customLocale

  pkp · pkp/customLocale

  Medium6.3
• CVE-2023-5898

  Cross-Site Request Forgery (CSRF) in pkp/pkp-lib

  pkp · pkp/pkp-lib

  Low3.5