{"id":"CVE-2019-19909","details":"An issue was discovered in Public Knowledge Project (PKP) pkp-lib before 3.1.2-2, as used in Open Journal Systems (OJS) before 3.1.2-2. Code injection can occur in the OJS report generator if an authenticated Journal Manager user visits a crafted URL, because unserialize is used.","modified":"2026-07-08T16:28:50.373766Z","published":"2019-12-19T19:15:14.200Z","references":[{"type":"ADVISORY","url":"https://github.com/pkp/pkp-lib/issues/5302"},{"type":"ADVISORY","url":"https://pkp.sfu.ca/ojs/ojs_download/"},{"type":"FIX","url":"https://github.com/pkp/pkp-lib/compare/3_1_2-1...3_1_2-2"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/pkp/ojs","events":[{"introduced":"0"},{"fixed":"ec5b7cd970ac38e62438a3d7081f8d8474eaf8dd"}],"database_specific":{"cpe":"cpe:2.3:a:sfu:open_journal_system:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"3.1.2-2"}],"source":"CPE_RANGE"}}],"versions":["ojs-3_1_2-1","3_1_2-1","ojs-3_1_2-0","3_1_2-0","ojs-3_0b1","ojs-3_0a1","ojs-2_4_0-0","ojs-2_3_3-1","ojs-2_3_3-0","ojs-2_3_0-0","ojs-2_3_0-0rc1","ojs2-base-2_2_2","ojs-2_2_1-0","ojs-2_2_1-b1","ojs-2_2_0-0","ojs-2_2_0-b2","ojs-2_2_0-b1","ojs-2_1_1-0","ojs-2_1_1rc4","ojs-2_1_0-1","ojs-2_1_0-0","ojs-2_1b","ojs-2_0_2-1","ojs-2_0_2-0","ojs-2_0_1-0","ojs-2_0_0-0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-19909.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}