CVE-2024-56525

Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days.

In Public Knowledge Project (PKP) OJS, OMP, and OPS before 3.3.0.21 and 3.4.x before 3.4.0.8, an XXE attack by the Journal Editor Role can create a new role as super admin in the journal context, and insert a backdoor plugin, by uploading a crafted XML document as a User XML Plugin.

Published 2025-02-24. Last modified 2026-06-17.