open_journal_systems vulnerabilities

CVEs whose affected-version data names the open_journal_systems package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-111609Low· 3.8

yesterday

PKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via updateSubscription

PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers c…

▾ SunlitPKP · Open Journal Systemsvia CVEORG