CVE-2026-114404

PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attribut...

CVE-2026-114404 PHPPresentation 1.2.0 XSS via Writer\HTML Text Runs, Hyperlinks and Descriptions

PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attribut...

EUVD-2026-107251

PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attribut...

CVE-2026-114404 PHPPresentation 1.2.0 XSS via Writer\HTML Text Runs, Hyperlinks and Descriptions

PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attribut...

CVE-2026-114404

PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting (XSS) vulnerability within its HTML writer. The root cause is the failure to properly escape certain presentation content attributes, specifically text runs , hyperlink relationship targets , and shape descr attributes . An attacker ...

EUVD-2026-107250

PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize,...

CVE-2026-114403

The PHPOffice PHPPresentation library (versions through 1.2.0 ) is vulnerable to an insecure deserialization flaw in the Reader bSerialized::load function. An attacker can exploit this by uploading a crafted ZIP file containing a PhpPresentation.xml file. When IOFactory::load processes this file,...

PT-2026-120591

PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attribut...