https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-7902.htmlhttps://patchthecve.com/cve/CVE-2024-7902.htmlWed, 17 Jun 2026 08:21:09 +0000MEDIUM 4.3: A vulnerability was found in pkp ojs up to 3.4.0-6 and classified as problematic. Affected by this issue is some unknown functionality of the file /login/signOut. The manipulation of the argument source with the input .example.com leads to open redirect. The attack may be launched remotely. The explhttps://patchthecve.com/cve/CVE-2024-25438.htmlhttps://patchthecve.com/cve/CVE-2024-25438.htmlWed, 17 Jun 2026 07:16:01 +0000MEDIUM 6.1: A cross-site scripting (XSS) vulnerability in the Submission module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Input subject field under the Add Discussion function.https://patchthecve.com/cve/CVE-2024-25436.htmlhttps://patchthecve.com/cve/CVE-2024-25436.htmlWed, 17 Jun 2026 07:16:01 +0000MEDIUM 6.1: A cross-site scripting (XSS) vulnerability in the Production module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Input subject field under the Add Discussion function.https://patchthecve.com/cve/CVE-2024-25434.htmlhttps://patchthecve.com/cve/CVE-2024-25434.htmlWed, 17 Jun 2026 07:16:01 +0000MEDIUM 5.4: A cross-site scripting (XSS) vulnerability in Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Publicname parameter.https://patchthecve.com/cve/CVE-2024-24512.htmlhttps://patchthecve.com/cve/CVE-2024-24512.htmlWed, 17 Jun 2026 07:14:33 +0000MEDIUM 6.1: Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the input subtitle component.https://patchthecve.com/cve/CVE-2024-24511.htmlhttps://patchthecve.com/cve/CVE-2024-24511.htmlWed, 17 Jun 2026 07:14:33 +0000MEDIUM 6.1: Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the Input Title component.https://patchthecve.com/cve/CVE-2023-6671.htmlhttps://patchthecve.com/cve/CVE-2023-6671.htmlWed, 17 Jun 2026 06:51:12 +0000MEDIUM 6.3: A vulnerability has been discovered on OJS, that consists in a CSRF (Cross-Site Request Forgery) attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated.https://patchthecve.com/cve/CVE-2023-5894.htmlhttps://patchthecve.com/cve/CVE-2023-5894.htmlWed, 17 Jun 2026 06:49:36 +0000MEDIUM 5.4: Cross-site Scripting (XSS) - Stored in GitHub repository pkp/ojs prior to 3.3.0-16.