High severity8.8NVD Advisory· Published Dec 19, 2019· Updated Jun 17, 2026

CVE-2019-19909

Description

An issue was discovered in Public Knowledge Project (PKP) pkp-lib before 3.1.2-2, as used in Open Journal Systems (OJS) before 3.1.2-2. Code injection can occur in the OJS report generator if an authenticated Journal Manager user visits a crafted URL, because unserialize is used.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Sfu/Open Journal System
cpe:2.3:a:sfu:open_journal_system:*:*:*:*:*:*:*:*
Range: <3.1.2-2
Public Knowledge Project/pkp-libdescription
Public Knowledge Project/pkp-libllm-create
Range: <3.1.2-2
Public Knowledge Project/Open Journal Systemsllm-fuzzy
Range: <3.1.2-2
Pkp/Pkp Libllm-fuzzy
Range: <3.1.2-2

Patches

Vulnerability mechanics

References

github.com/pkp/pkp-lib/compare/3_1_2-1...3_1_2-2nvdPatchThird Party Advisory
github.com/pkp/pkp-lib/issues/5302nvdThird Party Advisory
pkp.sfu.ca/ojs/ojs_download/nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000