105 matches found
XML External Entity (XXE) Injection
Overview phpoffice/phpspreadsheet is a Spreadsheet engine that Read, Create and Write Spreadsheet documents in PHP . Affected versions of this package are vulnerable to XML External Entity XXE Injection via the unentity method in src/PhpSpreadsheet/Reader/Xml.php, where HTML entities in XML...
Allocation of Resources Without Limits or Throttling
Overview phpoffice/phpspreadsheet is a Spreadsheet engine that Read, Create and Write Spreadsheet documents in PHP . Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the ODS file reader in src/PhpSpreadsheet/Reader/Ods.php, where the...
XML External Entity (XXE) Injection
Overview phpoffice/phpspreadsheet is a Spreadsheet engine that Read, Create and Write Spreadsheet documents in PHP . Affected versions of this package are vulnerable to XML External Entity XXE Injection via the ODS file reader in src/PhpSpreadsheet/Reader/Ods.php, where the...
Incorrect Authorization
Overview phpoffice/phpspreadsheet is a Spreadsheet engine that Read, Create and Write Spreadsheet documents in PHP . Affected versions of this package are vulnerable to Incorrect Authorization via the ODS file reader in src/PhpSpreadsheet/Reader/Ods.php and the XML scanner in...
CVE-2026-114404
PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attribut...
CVE-2026-114403
PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize,...
CVE-2026-114404 PHPPresentation 1.2.0 XSS via Writer\HTML Text Runs, Hyperlinks and Descriptions
PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attribut...
EUVD-2026-107251
PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attribut...
EUVD-2026-107250
PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize,...
CVE-2026-114403 PHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\Serialized::load
PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize,...
CVE-2026-114403
The PHPOffice PHPPresentation library (versions through 1.2.0 ) is vulnerable to an insecure deserialization flaw in the Reader bSerialized::load function. An attacker can exploit this by uploading a crafted ZIP file containing a PhpPresentation.xml file. When IOFactory::load processes this file,...
PT-2026-120591
PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attribut...
CLSA-2026-1786530064 TuxCare security update for phpoffice/phpspreadsheet (2 CVEs)
TuxCare rebuilt phpoffice/phpspreadsheet to address 2 CVEs. Fixed in 4.5.0-p3+tuxcare...
PT-2026-80104
TuxCare rebuilt phpoffice/phpspreadsheet to address 2 CVEs. Fixed in 4.5.0-p3+tuxcare...
CLSA-2026-1768525047 TuxCare security update for phpoffice/phpspreadsheet (1 CVE)
TuxCare rebuilt phpoffice/phpspreadsheet to address 1 CVE. Fixed in 4.5.0-p1+tuxcare...
PT-2026-75386
TuxCare rebuilt phpoffice/phpspreadsheet to address 5 CVEs. Fixed in 4.5.0-p2+tuxcare...
PT-2026-73707
TuxCare rebuilt phpoffice/phpspreadsheet to address 1 CVE. Fixed in 4.5.0-p1+tuxcare...
CVE-2025-23210
phpoffice/phpspreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions have been found to have a Bypass of the Cross-site Scripting XSS sanitizer using the javascript protocol and special characters. This issue has been addressed in versions 3.9.0, 2.3.7, 2.1....