CVE-2026-40296

creationtimestamp| type| source ---|---|--- 2026-05-07 02:45:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mla754dpfc2k...

CVE-2026-40296 PhpSpreadsheet vulnerable to XSS in HTML writer via custom number format codes

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The HTML writer skips htmlspecialchars escaping when a cell's formatted value differs from the original value. When a cell has a custom number format containing the text placeholder @ along with any additional literal...

PT-2026-35878

Name of the Vulnerable Software and Affected Versions PhpSpreadsheet affected versions not specified Description An HTML escaping bypass allows for Cross-Site Scripting XSS, a technique where malicious scripts are injected into otherwise trusted websites. Recommendations At the moment, there is n...