What’s Vulnerable › Vulnerabilities

CVE-2019-19909

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-12-19 · updated 2026-06-17
• Weakness: CWE-94

Description

An issue was discovered in Public Knowledge Project (PKP) pkp-lib before 3.1.2-2, as used in Open Journal Systems (OJS) before 3.1.2-2. Code injection can occur in the OJS report generator if an authenticated Journal Manager user visits a crafted URL, because unserialize is used.

Affected products

• Sfu Open Journal System: before 3.1.2-2 — fixed in 3.1.2-2

How to fix

Upgrade to a fixed version: Sfu Open Journal System 3.1.2-2. Check the vendor advisory for mitigations.

References

• https://github.com/pkp/pkp-lib/compare/3_1_2-1...3_1_2-2
• https://github.com/pkp/pkp-lib/issues/5302
• https://pkp.sfu.ca/ojs/ojs_download/
• https://github.com/pkp/pkp-lib/compare/3_1_2-1...3_1_2-2
• https://github.com/pkp/pkp-lib/issues/5302
• https://pkp.sfu.ca/ojs/ojs_download/

Get alerted when CVE-2019-19909 or the next vulnerability affects your stack