Description
A security vulnerability has been detected in Public Knowledge Project omp and ojs 3.3.0/3.4.0/3.5.0. Impacted is an unknown function of the file plugins/paymethod/manual/templates/paymentForm.tpl of the component Payment Instructions Setting Handler. The manipulation of the argument manualInstructions leads to cross site scripting. The attack can be initiated remotely. You should upgrade the affected component.
References (6)
Core 6
Core References
Permissions Required, VDB Entry vdb-entry
technical-description
https://vuldb.com/?id.333042
Permissions Required, VDB Entry signature
permissions-required
https://vuldb.com/?ctiid.333042
Permissions Required, VDB Entry third-party-advisory
https://vuldb.com/?submit.695020
Issue Tracking issue-tracking
https://github.com/pkp/pkp-lib/issues/12022
Issue Tracking issue-tracking
https://github.com/pkp/pkp-lib/issues/12022#event-20904087480
Issue Tracking issue-tracking
patch
https://github.com/pkp/pkp-lib/issues/12022#event-20904112770
Scores
CVSS v3
2.4
EPSS
0.0022
EPSS Percentile
12.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-79
CWE-94
Status
published
Products (6)
Public Knowledge Project/ojs
3.3.0
Public Knowledge Project/ojs
3.4.0
Public Knowledge Project/ojs
3.5.0
Public Knowledge Project/omp
3.3.0
Public Knowledge Project/omp
3.4.0
Public Knowledge Project/omp
3.5.0
Published
Nov 20, 2025
Tracked Since
Feb 18, 2026