CVE-2023-5626

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Cross-Site Request Forgery (CSRF) in GitHub repository pkp/ojs prior to 3.3.0-16.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
pkp	pkp/ojs	>= unspecified, < 3.3.0-16
pkp	open_journal_systems	< 3.3.0-16

References

https://github.com/pkp/ojs/commit/99a9f393190383454aa5ddffedffc89596f6c682Patch
https://huntr.dev/bounties/c99279c1-709a-4e7b-a042-010c2bb44d6bExploit, Patch, Third Party Advisory
https://github.com/pkp/ojs/commit/99a9f393190383454aa5ddffedffc89596f6c682Patch
https://huntr.dev/bounties/c99279c1-709a-4e7b-a042-010c2bb44d6bExploit, Patch, Third Party Advisory

Timeline

Published: Oct 18, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-56277.5A vulnerability has been identified in NPort 6000 Series, making the authentication mechanism vulnerable. This vulnerability arises from the CVE-2023-56296.1A CWE-601:URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability exists that could cause disclosure of information through phishi CVE-2023-56304.9A CWE-494: Download of Code Without Integrity Check vulnerability exists that could allow a privileged user to install an untrusted firmware CVE-2023-56315.4Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document CVE-2023-56327.5In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT e CVE-2023-56337.8The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory obje CVE-2023-56349.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ArslanSoft Education Portal allows SQL CVE-2023-56357.5Improper Protection for Outbound Error Messages and Alert Signals vulnerability in ArslanSoft Education Portal allows Account Footprinting. CVE-2023-56369.8Unrestricted Upload of File with Dangerous Type vulnerability in ArslanSoft Education Portal allows Command Injection. This issue affects E CVE-2023-56377.5Unrestricted Upload of File with Dangerous Type vulnerability in ArslanSoft Education Portal allows Read Sensitive Strings Within an Executa CVE-2023-56385.4The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wcj_image' shortcode in versions up to, a CVE-2023-56395.4The Team Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tmfshortcode' shortcode in all version