Public Knowledge Project develops a suite of open-source scholarly publishing and conference-management platforms—including Open Journal Systems, Open Conference Systems, Open Harvester Systems, and Open Monograph Press—that are widely adopted by academic institutions and research organizations worldwide. The vendor's vulnerability profile centers on web-application input-handling and session-management weaknesses, particularly cross-site scripting, cross-site request forgery, and open-redirect flaws that recur across its platform portfolio and reflect the complexity of managing user-generated content and authentication in publishing workflows. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Public Knowledge Project over time
Signals from CVEs in this vendor scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-24181MEDIUM Cross-site scripting (XSS) via Host Header injection in PKP Open Journals System 2.4.8 >= 3.3 allows remote attackers to inject arbitary code via the X-Forwarded-Host Header. | Apr 1, 2022 | 6.1 | 41 | NO | YES |
CVE-2011-5195MEDIUM Cross-site request forgery (CSRF) vulnerability in index/manager/fileUpload in Public Knowledge Project Open Conference Systems 2.3.4 and earlier allows remote attackers to hijack | Sep 23, 2012 | 6.8 | 31 | NO | YES |
CVE-2011-5197MEDIUM Cross-site request forgery (CSRF) vulnerability in index/manager/fileUpload in Public Knowledge Project Open Harvester Systems 2.3.1 and earlier allows remote attackers to hijack t | Sep 23, 2012 | 6.8 | 30 | NO | YES |
CVE-2011-5196MEDIUM Cross-site request forgery (CSRF) vulnerability in index/manager/fileUpload in Public Knowledge Project Open Journal Systems 2.3.6 and earlier allows remote attackers to hijack the | Sep 23, 2012 | 6.8 | 30 | NO | YES |
CVE-2022-26616MEDIUM PKP Vendor Open Journal System v2.4.8 to v3.3.8 allows attackers to perform reflected cross-site scripting (XSS) attacks via crafted HTTP headers. | Apr 4, 2022 | 6.1 | 22 | NO | NO |
CVE-2018-12588MEDIUM Cross-site scripting (XSS) vulnerability in templates/frontend/pages/searchResults.tpl in Public Knowledge Project (PKP) Open Monograph Press (OMP) v1.2.0 through 3.1.1-2 before 3. | Jun 19, 2018 | 6.1 | 20 | NO | NO |
CVE-2024-7902MEDIUM A vulnerability was found in pkp ojs up to 3.4.0-6 and classified as problematic. Affected by this issue is some unknown functionality of the file /login/signOut. The manipulation | Aug 17, 2024 | 6.1 | 19 | NO | NO |
CVE-2024-25438MEDIUM A cross-site scripting (XSS) vulnerability in the Submission module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into th | Mar 1, 2024 | 6.1 | 18 | NO | NO |
Signals from CVEs in this vendor scope (8 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Public Knowledge Project.
Media articles that mention a CVE ID that affects a product developed by Public Knowledge Project — matched by CVE ID, not by vendor name.