VULNERABILITY INTELLIGENCE

CVE-2019-19909

CVSS score8.8 HIGH
EPSS probability1.39%
CISA KEVNot currently listed
Published2019-12-19
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

An issue was discovered in Public Knowledge Project (PKP) pkp-lib before 3.1.2-2, as used in Open Journal Systems (OJS) before 3.1.2-2. Code injection can occur in the OJS report generator if an authenticated Journal Manager user visits a crafted URL, because unserialize is used.

Weakness classification

  • CWE-94: Improper Control of Generation of Code ('Code Injection')
  • CWE-502: Deserialization of Untrusted Data

Primary references