First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2023-5896

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.4.0-4.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
pkp	pkp/pkp-lib	>= unspecified, < 3.4.0-4

References

https://github.com/pkp/pkp-lib/commit/18b318f83105ffa7fa214179f8e20507b0754236Patch
https://huntr.com/bounties/a1f05be5-24ed-4ec5-9858-fce4233f7bb1Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/pkp/pkp-lib/commit/18b318f83105ffa7fa214179f8e20507b0754236Patch
https://huntr.com/bounties/a1f05be5-24ed-4ec5-9858-fce4233f7bb1Exploit, Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Nov 1, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-58978.8Cross-Site Request Forgery (CSRF) in GitHub repository pkp/customLocale prior to 1.2.0-1.CVE-2023-58988.8Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.CVE-2023-58998.8Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.CVE-2023-59004.3Cross-Site Request Forgery in GitHub repository pkp/pkp-lib prior to 3.3.0-16.CVE-2023-59014.8Cross-site Scripting in GitHub repository pkp/pkp-lib prior to 3.3.0-16.CVE-2023-59024.3Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.CVE-2023-59035.4Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.CVE-2023-59045.4Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.CVE-2023-59058.1The DeMomentSomTres WordPress Export Posts With Images WordPress plugin through 20220825 does not check authorization of requests to export CVE-2023-59067.5The Job Manager & Career WordPress plugin before 1.4.4 contains a vulnerability in the Directory Listings system, which allows an unauthoriz CVE-2023-59076.5The File Manager WordPress plugin before 6.3 does not restrict the file managers root directory, allowing an administrator to set a root out CVE-2023-59089.1KEPServerEX is vulnerable to a buffer overflow which may allow an attacker to crash the product being accessed or leak information.