medium6.1Public exploit code
CVE-2022-24181
Cross-site scripting (XSS) via Host Header injection in PKP Open Journals System 2.4.8 >= 3.3 allows remote attackers to inject arbitary code via the X-Forward…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- PKP Open Journals System 3.3 - Cross-Site Scripting (XSS)2022-04-19 · webapps · php
Impact
Cross-site scripting (XSS) via Host Header injection in PKP Open Journals System 2.4.8 >= 3.3 allows remote attackers to inject arbitary code via the X-Forwarded-Host Header.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Public Knowledge Project | Open Journal Systems | from 2.4.8 through 3.3 |