PT-2025-47575 · Public Knowledge · Ojs+1

Tsuretettee · Published 2025-11-20 · Updated 2025-11-20 · CVE-2025-13469

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Public Knowledge Project omp and ojs versions 3.3.0 through 3.5.0

Description A security issue exists in Public Knowledge Project omp and ojs. The manipulation of the manualInstructions argument in an unknown function within the file plugins/paymethod/manual/templates/paymentForm.tpl of the Payment Instructions Setting Handler component can lead to cross site scripting. This attack can be initiated remotely.

Recommendations Upgrade the affected component to address this issue.

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-13469

Affected Products

Ojs

Omp

References · 10

• https://github.com/pkp/pkp-lib/issues/12022#event-20904112770 · Patch
• https://osv.dev/vulnerability/CVE-2025-13469 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13469 · Security Note
• https://github.com/pkp/pkp-lib/issues/12022 · Note
• https://github.com/pkp/pkp-lib/issues/12022#event-20904087480 · Note
• https://twitter.com/CVEnew/status/1991502512537395474 · Twitter Post
• https://vuldb.com/?id.333042 · Note
• https://twitter.com/VulmonFeeds/status/1991578616920990099 · Twitter Post
• https://vuldb.com/?ctiid.333042 · Note
• https://vuldb.com/?submit.695020 · Note