Critical OJS Vulnerability: How an “Add Reviewer” Flaw Led to an Admin Takeover
Picture this: an account called “esciassessor” has been sitting quietly on one of our clients’ OJS sites since 2022. Then one morning, out of nowhere, it becomes the most powerful admin on the site. No cracked passwords, no endless login attempts. The attacker just slipped through a tiny gap in OJS that PKP, the folks […]
