{"kind": "product", "path": "vulns/packagist/phpoffice%2Fphpexcel", "name": "phpoffice/phpexcel", "product": "phpoffice/phpexcel", "ecosystem": "Packagist", "items": [{"id": "CVE-2025-23210", "noindex": false, "published": "2025-02-03T21:14:57.255Z", "modified": "2025-02-04T15:33:39.661Z", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.00415, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2025-23210", "title": "Bypass XSS sanitizer using the javascript protocol and special characters in phpoffice/phpspreadsheet", "description": "phpoffice/phpspreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions have been found to have a Bypass of the Cross-site Scripting (XSS) sanitizer using the javascript protocol and special characters. This issue has been addressed in versions 3.9.0, 2.3.7, 2.1.8, and 1.29.9. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "references": ["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-r57h-547h-w24f", "https://github.com/PHPOffice/PhpSpreadsheet/commit/cde2926a9e2baf146783f8fd1771bbed7d1dc7b3", "https://nvd.nist.gov/vuln/detail/CVE-2025-23210"], "fixes": [], "products": [{"name": "phpoffice/phpexcel", "path": "vulns/packagist/phpoffice%2Fphpexcel", "ecosystem": "Packagist"}]}, {"id": "CVE-2025-22131", "noindex": false, "published": "2025-01-20T15:31:19.693Z", "modified": "2025-01-21T14:58:15.541Z", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.00393, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2025-22131", "title": "Cross-Site Scripting (XSS) vulnerability in generateNavigation() function", "description": "PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Cross-Site Scripting (XSS) vulnerability in the code which translates the XLSX file into a HTML representation and displays it in the response.", "references": ["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-79xx-vf93-p7cx", "https://github.com/PHPOffice/PhpSpreadsheet/commit/4088381ccfaf241d7d42c333de0dc8c98e338743", "https://nvd.nist.gov/vuln/detail/CVE-2025-22131"], "fixes": [], "products": [{"name": "phpoffice/phpexcel", "path": "vulns/packagist/phpoffice%2Fphpexcel", "ecosystem": "Packagist"}]}, {"id": "CVE-2024-56412", "noindex": false, "published": "2025-01-03T17:20:51.827Z", "modified": "2025-01-03T17:35:43.196Z", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.0039, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2024-56412", "title": "PhpSpreadsheet vulnerable to bypass of the XSS sanitizer using the javascript protocol and special characters", "description": "PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to bypass of the cross-site scripting sanitizer using the javascript protocol and special characters. An attacker can use special characters, so that the library processes the javascript protocol with special characters and generates an HTML link. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.", "references": ["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-q9jv-mm3r-j47r", "https://github.com/PHPOffice/PhpSpreadsheet/commit/45052f88e04c735d56457a8ffcdc40b2635a028e", "https://nvd.nist.gov/vuln/detail/CVE-2024-56412"], "fixes": [], "products": [{"name": "phpoffice/phpexcel", "path": "vulns/packagist/phpoffice%2Fphpexcel", "ecosystem": "Packagist"}]}, {"id": "CVE-2024-56411", "noindex": false, "published": "2025-01-03T17:19:00.339Z", "modified": "2025-01-03T17:37:25.986Z", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.00369, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2024-56411", "title": "PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header", "description": "PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have a cross-site scripting (XSS) vulnerability of the hyperlink base in the HTML page header. The HTML page is formed without sanitizing the hyperlink base. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.", "references": ["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-hwcp-2h35-p66w", "https://github.com/PHPOffice/PhpSpreadsheet/commit/45052f88e04c735d56457a8ffcdc40b2635a028e", "https://nvd.nist.gov/vuln/detail/CVE-2024-56411"], "fixes": [], "products": [{"name": "phpoffice/phpexcel", "path": "vulns/packagist/phpoffice%2Fphpexcel", "ecosystem": "Packagist"}]}, {"id": "CVE-2024-56410", "noindex": false, "published": "2025-01-03T17:17:52.596Z", "modified": "2025-01-03T20:11:13.518Z", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.00337, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2024-56410", "title": "PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability in custom properties", "description": "PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have a cross-site scripting (XSS) vulnerability in custom properties. The HTML page is generated without clearing custom properties. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.", "references": ["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-wv23-996v-q229", "https://github.com/PHPOffice/PhpSpreadsheet/commit/45052f88e04c735d56457a8ffcdc40b2635a028e", "https://nvd.nist.gov/vuln/detail/CVE-2024-56410"], "fixes": [], "products": [{"name": "phpoffice/phpexcel", "path": "vulns/packagist/phpoffice%2Fphpexcel", "ecosystem": "Packagist"}]}, {"id": "CVE-2024-56409", "noindex": false, "published": "2025-01-03T17:05:43.272Z", "modified": "2025-01-03T18:14:49.852Z", "cvss": 8.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L", "severity": "high", "epss": 0.0034, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2024-56409", "title": "PhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php file", "description": "PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the `Currency.php` file. Using the `/vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Currency.php` script, an attacker can perform a cross-site scripting attack. Versions  3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.", "references": ["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-j2xg-cjcx-4677", "https://github.com/PHPOffice/PhpSpreadsheet/commit/700a80346be269af668914172bc6f4521982d0b4", "https://nvd.nist.gov/vuln/detail/CVE-2024-56409"], "fixes": [], "products": [{"name": "phpoffice/phpexcel", "path": "vulns/packagist/phpoffice%2Fphpexcel", "ecosystem": "Packagist"}]}, {"id": "CVE-2024-56366", "noindex": false, "published": "2025-01-03T17:01:09.701Z", "modified": "2025-01-03T18:15:53.839Z", "cvss": 8.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L", "severity": "high", "epss": 0.0034, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2024-56366", "title": "PhpSpreadsheet vulnerable to unauthorized reflected  XSS in the Accounting.php file", "description": "PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the `Accounting.php` file. Using the `/vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Accounting.php` script, an attacker can perform a cross-site scripting attack. Versions  3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.", "references": ["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-c6fv-7vh8-2rhr", "https://github.com/PHPOffice/PhpSpreadsheet/commit/700a80346be269af668914172bc6f4521982d0b4", "https://nvd.nist.gov/vuln/detail/CVE-2024-56366"], "fixes": [], "products": [{"name": "phpoffice/phpexcel", "path": "vulns/packagist/phpoffice%2Fphpexcel", "ecosystem": "Packagist"}]}, {"id": "CVE-2024-56365", "noindex": false, "published": "2025-01-03T16:56:35.040Z", "modified": "2025-01-03T18:16:40.533Z", "cvss": 8.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L", "severity": "high", "epss": 0.00332, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2024-56365", "title": "PhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader class", "description": "PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the constructor of the `Downloader` class. Using the `/vendor/phpoffice/phpspreadsheet/samples/download.php` script, an attacker can perform a cross-site scripting attack. Versions  3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.", "references": ["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-jmpx-686v-c3wx", "https://github.com/PHPOffice/PhpSpreadsheet/commit/700a80346be269af668914172bc6f4521982d0b4#diff-fbb0f53a5c68eeeffaa9ab35552c0b01740396f1a4045af5d2935ec2a62a7816", "https://nvd.nist.gov/vuln/detail/CVE-2024-56365"], "fixes": [], "products": [{"name": "phpoffice/phpexcel", "path": "vulns/packagist/phpoffice%2Fphpexcel", "ecosystem": "Packagist"}]}, {"id": "CVE-2024-56408", "noindex": false, "published": "2025-01-03T16:05:22.944Z", "modified": "2025-05-20T18:30:55.096Z", "cvss": 8.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L", "severity": "high", "epss": 0.00414, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2024-56408", "title": "PhpSpreadsheet allows unauthorized reflected XSS in `Convert-Online.php` file", "description": "PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have no sanitization in the `/vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.php` file, which leads to the possibility of a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.", "references": ["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-x88g-h956-m5xg", "https://github.com/PHPOffice/PhpSpreadsheet/commit/700a80346be269af668914172bc6f4521982d0b4", "https://github.com/PHPOffice/PhpSpreadsheet/commit/9b9a55c7154daa7cd4095f618933c240508ba3c1"], "fixes": [], "products": [{"name": "phpoffice/phpexcel", "path": "vulns/packagist/phpoffice%2Fphpexcel", "ecosystem": "Packagist"}]}, {"id": "CVE-2024-48917", "noindex": false, "published": "2024-11-18T19:48:42.656Z", "modified": "2024-11-18T20:15:55.299Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.00728, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2024-48917", "title": "XXE in PHPSpreadsheet's XLSX reader", "description": "PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. The `XmlScanner` class has a scan method which should prevent XXE attacks. However, in a bypass of the previously reported `CVE-2024-47873`, the regexes from the `findCharSet` method, which is used for determining the current encoding can be bypassed by using a payload in the encoding UTF-7, and adding at end of the file a comment with the value `encoding=\"UTF-8\"` with `\"`, which is matched by the first regex, so that `encoding='UTF-7'` with single quotes `'` in the XML header is not matched by the second regex. An attacker can bypass the sanitizer and achieve an XML e", "references": ["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-7cc9-j4mv-vcjp", "https://github.com/PHPOffice/PhpSpreadsheet/blob/39fc51309181e82593b06e2fa8e45ef8333a0335/src/PhpSpreadsheet/Reader/Security/XmlScanner.php", "https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing"], "fixes": [], "products": [{"name": "phpoffice/phpexcel", "path": "vulns/packagist/phpoffice%2Fphpexcel", "ecosystem": "Packagist"}]}, {"id": "CVE-2024-47873", "noindex": false, "published": "2024-11-18T17:03:00.366Z", "modified": "2024-11-18T18:28:36.292Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.0076, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2024-47873", "title": "PhpSpreadsheet XmlScanner bypass leads to XXE", "description": "PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. The XmlScanner class has a scan method which should prevent XXE attacks. However, prior to versions 1.9.4, 2.1.3, 2.3.2, and 3.4.0, the regexes used in the `scan` method and the findCharSet method can be bypassed by using UCS-4 and encoding guessing. An attacker can bypass the sanitizer and achieve an XML external entity attack. Versions 1.9.4, 2.1.3, 2.3.2, and 3.4.0 fix the issue.", "references": ["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-jw4x-v69f-hh5w", "https://github.com/PHPOffice/PhpSpreadsheet/blob/39fc51309181e82593b06e2fa8e45ef8333a0335/src/PhpSpreadsheet/Reader/Security/XmlScanner.php", "https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing"], "fixes": [], "products": [{"name": "phpoffice/phpexcel", "path": "vulns/packagist/phpoffice%2Fphpexcel", "ecosystem": "Packagist"}]}, {"id": "CVE-2015-3542", "noindex": false, "published": "2024-11-07T17:28:59Z", "modified": "2024-11-07T17:59:25.503866Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2015-3542", "title": "PHPExcel XXE Vulnerability", "description": "PHPExcel XXE Vulnerability", "references": ["https://github.com/PHPOffice/PHPExcel/commit/0ab614fd952f82f9b7a9280731daa2300e6b000c", "https://github.com/FriendsOfPHP/security-advisories/blob/master/phpoffice/phpexcel/CVE-2015-3542.yaml", "https://github.com/PHPOffice/PHPExcel"], "fixes": ["1.8.1"], "products": [{"name": "phpoffice/phpexcel", "path": "vulns/packagist/phpoffice%2Fphpexcel", "ecosystem": "Packagist"}]}, {"id": "CVE-2024-45060", "noindex": false, "published": "2024-10-07T20:15:35.087Z", "modified": "2024-10-08T18:28:48.263Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N", "severity": "high", "epss": 0.00507, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2024-45060", "title": "Unauthenticated Cross-Site-Scripting (XSS) in sample file in PHPSpreadsheet", "description": "PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. One of the sample scripts in PhpSpreadsheet is susceptible to a cross-site scripting (XSS) vulnerability due to improper handling of input where a number is expected leading to formula injection. The code in in `45_Quadratic_equation_solver.php` concatenates the user supplied parameters directly into spreadsheet formulas. This allows an attacker to take control over the formula and output unsanitized data into the page, resulting in JavaScript execution. This issue has been addressed in release versions 1.29.2, 2.1.1, and 2.3.0. All users are advised to upgrade. T", "references": ["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-v66g-p9x6-v98p", "https://github.com/PHPOffice/PhpSpreadsheet/blob/d50b8b5de7e30439fb57eae7df9ea90e79fa0f2d/samples/Basic/45_Quadratic_equation_solver.php#L56", "https://nvd.nist.gov/vuln/detail/CVE-2024-45060"], "fixes": [], "products": [{"name": "phpoffice/phpexcel", "path": "vulns/packagist/phpoffice%2Fphpexcel", "ecosystem": "Packagist"}]}, {"id": "CVE-2024-45290", "noindex": false, "published": "2024-10-07T20:12:38.190Z", "modified": "2024-10-08T18:31:06.318Z", "cvss": 7.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "severity": "high", "epss": 0.00625, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2024-45290", "title": "Path traversal and Server-Side Request Forgery when opening XLSX files in PHPSpreadsheet", "description": "PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file which links media from external URLs. When opening the XLSX file, PhpSpreadsheet retrieves the image size and type by reading the file contents, if the provided path is a URL. By using specially crafted `php://filter` URLs an attacker can leak the contents of any file or URL. Note that this vulnerability is different from GHSA-w9xv-qf98-ccq4, and resides in a different component. An attacker can access any file on the server, or leak information form arbitrary URLs, potentially exposing sensitive information ", "references": ["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-5gpr-w2p5-6m37", "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-w9xv-qf98-ccq4", "https://nvd.nist.gov/vuln/detail/CVE-2024-45290"], "fixes": [], "products": [{"name": "phpoffice/phpexcel", "path": "vulns/packagist/phpoffice%2Fphpexcel", "ecosystem": "Packagist"}]}, {"id": "CVE-2024-45291", "noindex": false, "published": "2024-10-07T20:09:58.029Z", "modified": "2024-10-08T18:32:25.328Z", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "severity": "medium", "epss": 0.00864, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2024-45291", "title": "Path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled in PHPSpreadsheet", "description": "PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file that links images from arbitrary paths. When embedding images has been enabled in HTML writer with `$writer->setEmbedImages(true);` those files will be included in the output as `data:` URLs, regardless of the file's type. Also URLs can be used for embedding, resulting in a Server-Side Request Forgery vulnerability. When embedding images has been enabled, an attacker can read arbitrary files on the server and perform arbitrary HTTP GET requests. Note that any PHP protocol wrappers can be used, meaning that if", "references": ["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-w9xv-qf98-ccq4", "https://nvd.nist.gov/vuln/detail/CVE-2024-45291"], "fixes": [], "products": [{"name": "phpoffice/phpexcel", "path": "vulns/packagist/phpoffice%2Fphpexcel", "ecosystem": "Packagist"}]}, {"id": "CVE-2024-45292", "noindex": false, "published": "2024-10-07T20:06:13.595Z", "modified": "2024-10-07T20:26:37.224Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00344, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2024-45292", "title": "PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks", "description": "PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. `\\PhpOffice\\PhpSpreadsheet\\Writer\\Html` does not sanitize \"javascript:\" URLs from hyperlink `href` attributes, resulting in a Cross-Site Scripting vulnerability. This issue has been addressed in release versions 1.29.2, 2.1.1, and 2.3.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.", "references": ["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-r8w8-74ww-j4wh", "https://nvd.nist.gov/vuln/detail/CVE-2024-45292"], "fixes": [], "products": [{"name": "phpoffice/phpexcel", "path": "vulns/packagist/phpoffice%2Fphpexcel", "ecosystem": "Packagist"}]}, {"id": "CVE-2024-45293", "noindex": false, "published": "2024-10-07T20:03:27.080Z", "modified": "2024-10-07T20:25:10.635Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.02776, "kev": false, "exploits": ["nuclei"], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2024-45293", "title": "XML External Entity Reference (XXE) in PHPSpreadsheet's XLSX reader", "description": "PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The security scanner responsible for preventing XXE attacks in the XLSX reader can be bypassed by slightly modifying the XML structure, utilizing white-spaces. On servers that allow users to upload their own Excel (XLSX) sheets, Server files and sensitive information can be disclosed by providing a crafted sheet. The security scan function in src/PhpSpreadsheet/Reader/Security/XmlScanner.php contains a flawed XML encoding check to retrieve the input file's XML encoding in the toUtf8 function. The function searches for the XML encoding through a defined regex which", "references": ["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hwr-6v2f-3m88", "https://nvd.nist.gov/vuln/detail/CVE-2024-45293"], "fixes": [], "products": [{"name": "phpoffice/phpexcel", "path": "vulns/packagist/phpoffice%2Fphpexcel", "ecosystem": "Packagist"}]}, {"id": "CVE-2024-45046", "noindex": false, "published": "2024-08-28T20:41:23.628Z", "modified": "2024-08-29T13:11:25.969Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00418, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2024-45046", "title": "PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information", "description": "PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In affected versions `\\PhpOffice\\PhpSpreadsheet\\Writer\\Html` doesn't sanitize spreadsheet styling information such as font names, allowing an attacker to inject arbitrary JavaScript on the page. As a result an attacker may used a crafted spreadsheet to fully takeover a session of a user viewing spreadsheet files as HTML. This issue has been addressed in release version 2.1.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.", "references": ["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-wgmf-q9vr-vww6", "https://github.com/PHPOffice/PhpSpreadsheet/pull/3957", "https://github.com/PHPOffice/PhpSpreadsheet/commit/f7cf378faed2e11cf4825bf8bafea4922ae44667"], "fixes": [], "products": [{"name": "phpoffice/phpexcel", "path": "vulns/packagist/phpoffice%2Fphpexcel", "ecosystem": "Packagist"}]}, {"id": "CVE-2024-45048", "noindex": false, "published": "2024-08-28T20:38:29.486Z", "modified": "2024-08-29T13:10:20.156Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00605, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2024-45048", "title": "XML External Entity Reference (XXE) in PHPSpreadsheet", "description": "PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions are subject to a bypassing of a filter which allows for an XXE-attack. This in turn allows attacker to obtain contents of local files, even if error reporting is muted. This vulnerability has been addressed in release version 2.2.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.", "references": ["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-ghg6-32f9-2jp7", "https://github.com/PHPOffice/PhpSpreadsheet/commit/bea2d4b30f24bcc8a7712e208d1359e603b45dda", "https://nvd.nist.gov/vuln/detail/CVE-2024-45048"], "fixes": [], "products": [{"name": "phpoffice/phpexcel", "path": "vulns/packagist/phpoffice%2Fphpexcel", "ecosystem": "Packagist"}]}, {"id": "CVE-2020-7776", "noindex": false, "published": "2020-12-09T16:45:18.358Z", "modified": "2024-09-16T19:39:56.390Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N/E:P/RL:O/RC:C", "severity": "high", "epss": 0.01317, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2020-7776", "title": "Cross-site Scripting (XSS)", "description": "This affects the package phpoffice/phpspreadsheet from 0.0.0. The library is vulnerable to XSS when creating an html output from an excel file by adding a comment on any cell. The root cause of this issue is within the HTML writer where user comments are concatenated as part of link and this is returned as HTML. A fix for this issue is available on commit 0ed5b800be2136bcb8fa9c1bdf59abc957a98845/master branch.", "references": ["https://snyk.io/vuln/SNYK-PHP-PHPOFFICEPHPSPREADSHEET-1048856", "https://github.com/PHPOffice/PhpSpreadsheet/commit/0ed5b800be2136bcb8fa9c1bdf59abc957a98845", "https://github.com/PHPOffice/PhpSpreadsheet/blob/master/src/PhpSpreadsheet/Writer/Html.php%23L1792"], "fixes": [], "products": [{"name": "phpoffice/phpexcel", "path": "vulns/packagist/phpoffice%2Fphpexcel", "ecosystem": "Packagist"}]}], "total": 23, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "phpoffice/phpexcel", "path": "vulns/packagist/phpoffice%2Fphpexcel", "ecosystem": "Packagist"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2025-05-20T18:30:55.096Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}