Design/Logic Flaw

An unescaped payload in exceljs v1.6 allows a possible XSS via cell value when worksheet is displayed in browser...

CVE-2018-16459

An unescaped payload in exceljs v1.6 allows a possible XSS via cell value when worksheet is displayed in browser...

CVE-2018-16459

An unescaped payload in exceljs v1.6 allows a possible XSS via cell value when worksheet is displayed in browser...

CVE-2018-16459

An unescaped payload in exceljs v1.6 allows a possible XSS via cell value when worksheet is displayed in browser...

CVE-2018-16459

Summary: CVE-2018-16459 relates to the exceljs library. Affected software: exceljs prior to 1.6.0. Vulnerability: unescaped payload in cell values leads to cross-site scripting (XSS) when a worksheet is rendered in a browser, because parsed XLSX data is not validated and HTML tags (e.g., [removed...

88slot-ap (1.0.0), @ciortanmadalina/angular2-translations-synchroniser (>=1.0.12, <=1.0.19) +64 more potentially affected by CVE-2018-16459 via exceljs (>=0.2.4, <=1.5.1)

exceljs NPM version =0.2.4, =1.0.12, =2.0.0-beta.1, =1.1.0-beta.143, =1.0.0, =1.0.0, =0.0.4, =1.0.0, =1.0.0, =10.0.0, =1.0.0, =2.0.0, =3.0.0, =1.0.49, =16.2.1 - archway-generator-cli 0.1.0 and more Source cves: CVE-2018-16459 Source advisory: MEND:CVE-2018-16459...

CVE-2018-16459

An unescaped payload in exceljs v1.6 allows a possible XSS via cell value when worksheet is displayed in browser...

PT-2018-13584

Name of the Vulnerable Software and Affected Versions exceljs versions prior to 1.6.0 Description The issue is related to an unescaped payload in exceljs, allowing a possible cross-site scripting XSS attack via cell value when a worksheet is displayed in a browser. This is due to exceljs not...

Cross-site Scripting (XSS)

exceljs is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitize the cells in the table, allowing a malicious user to inject and execute arbitrary Javascript...

Node.js third-party modules: [exceljs] Possible XSS via cell value when worksheet is displayed in browser

Hi Team, I would like to report Stored XSS vulnerability in exceljs module. It allows to execute JavaScript code embeded in the XLS sheet when data from the sheet are displayed in the browser. Module module name: exceljs version: 1.4.6 npm page: https://www.npmjs.com/package/exceljs Module...