Cross-Site Scripting Vulnerability in Pkp OJS by PKP
CVE-2024-25434

5.4MEDIUM

Key Information:

Vendor

PKP

Status
Pkp OJS
Vendor
CVE Published:
1 March 2024

What is CVE-2024-25434?

A cross-site scripting (XSS) vulnerability exists in Pkp OJS version 3.3, enabling attackers to exploit a weakness in the Publicname parameter. By crafting a malicious payload, an attacker can inject and execute arbitrary web scripts or HTML, potentially compromising user data and application security. This vulnerability highlights the importance of input validation and sanitization in web applications to prevent unauthorized script execution.

References

https://drive.google.com/file/d/1MFuAyZukdJeA7HKz8o8pOKLJ...
https://github.com/machisri/CVEs-and-Vulnerabilities/blob...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.