AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2024-56525

CRITICAL · CVSS 9.8 EPSS 0.40%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2025-02-24 · Last synced 2026-08-04

CyberRota Analysis

This is a critical severity vulnerability with a CVSS score of 9.8. See the original NVD description below for full technical details.

CVE
CVE-2024-56525
Severity
CRITICAL
CVSS
9.8
EPSS
0.40%

Original NVD Description

In Public Knowledge Project (PKP) OJS, OMP, and OPS before 3.3.0.21 and 3.4.x before 3.4.0.8, an XXE attack by the Journal Editor Role can create a new role as super admin in the journal context, and insert a backdoor plugin, by uploading a crafted XML document as a User XML Plugin.