CVE-2018-12588

Cross-site scripting (XSS) vulnerability in templates/frontend/pages/searchResults.tpl in Public Knowledge Project (PKP) Open Monograph Press (OMP) v1.2.0 through 3.1.1-2 before 3.1.1-3 allows remote attackers to inject arbitrary web script or HTML via the catalog.noTitlesSearch parameter (aka the Search field).

• CWE-79

• https://forum.pkp.sfu.ca/t/ojs-3-1-1-2-and-omp-3-1-1-3-released/45937Exploit, Patch, Vendor Advisory
• https://forum.pkp.sfu.ca/t/xss-vulnerability-alert/45938Vendor Advisory
• https://github.com/pkp/omp/commit/bfdcdec64865238163282c5940a6c7896c0977bfPatch, Third Party Advisory
• https://github.com/pkp/pkp-lib/issues/3805Exploit, Third Party Advisory
• https://metamorfosec.com/Files/Advisories/METS-2018-002-A_XSS_Vulnerability_in_OMP_1.2.0_to_3.1.1-2.txtTechnical Description, Third Party Advisory
• https://forum.pkp.sfu.ca/t/ojs-3-1-1-2-and-omp-3-1-1-3-released/45937Exploit, Patch, Vendor Advisory
• https://forum.pkp.sfu.ca/t/xss-vulnerability-alert/45938Vendor Advisory
• https://github.com/pkp/omp/commit/bfdcdec64865238163282c5940a6c7896c0977bfPatch, Third Party Advisory
• https://github.com/pkp/pkp-lib/issues/3805Exploit, Third Party Advisory
• https://metamorfosec.com/Files/Advisories/METS-2018-002-A_XSS_Vulnerability_in_OMP_1.2.0_to_3.1.1-2.txtTechnical Description, Third Party Advisory

Published

Jun 19, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-12581An issue was discovered in js/designer/move.js in phpMyAdmin…
• CVE-2018-12582An issue was discovered in AKCMS 6.1. CSRF can add an admin …
• CVE-2018-12583An issue was discovered in AKCMS 6.1. CSRF can delete an art…
• CVE-2018-12584The ConnectionBase::preparseNewBytes function in resip/stack…9.8
• CVE-2018-12585An XXE vulnerability in the OPC UA Java and .NET Legacy Stac…
• CVE-2018-12587A cross-site scripting (XSS) vulnerability was found in vale…
• CVE-2018-12589Polaris Office 2017 8.1 allows attackers to execute arbitrar…
• CVE-2018-1259Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 …7.5
• CVE-2018-12590Ubiquiti Networks EdgeSwitch version 1.7.3 and prior suffer …7.2
• CVE-2018-12591Ubiquiti Networks EdgeSwitch version 1.7.3 and prior suffer …
• CVE-2018-12592Polycom RealPresence Web Suite before 2.2.0 does not block a…
• CVE-2018-12594Reliable Controls MACH-ProWebCom 7.80 devices allow remote a…7.5