CVE-2025-22131-PoC

CVE-2025-22131-PoC PoC pour CVE-2025-22131 PhpSpreadsheet est une bibliothèque écrite en PHP pur et propose un ensemble de classes qui permettent de lire et d'écrire divers formats de fichiers tableurs comme Excel et LibreOffice Calc. phpspreadsheet version =2.2.0, =2.0.0, =3.0.0, sheetIndex ===...

CVE-2026-100242

The Mediawiki - DataTransfer Extension (versions 1.46.0 before 1.47.0 ) is vulnerable to a Dependency on Vulnerable Third-Party Component and Uncontrolled Resource Consumption (CWE-1395, CWE-400). The issue stems from a dependency on a phpspreadsheet version susceptible to CVE-2026-59933 , which ...

CVE-2026-100242 DataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion)

Dependency on Vulnerable Third-Party Component and Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Excessive Allocation. This issue affects Mediawiki - DataTransfer Extension: from 1.46.0 before 1.47.0...

CVE-2026-45034

🧨 Эксплойт Phar-десериализации PHPSpreadsheet ОбходprohibitWrappers + удалённое выполнение кода RCE в phpoffice/phpspreadsheet Этот репозиторий предоставляет эксплойт proof-of-concept PoC для критической уязвимости в популярной PHP-библиотеке PHPSpreadsheet. Атака использует обёртку потокаphar://...

CVE-2024-45427-Exploit

Генератор эксплойта CVE-2024-45427 Этот скрипт генерирует вредоносный файл Excel .xlsx для эксплуатации CVE-2024-45427 в библиотеке PhpSpreadsheet v3.7.0. Он внедряет XSS-пейлоад в имя листа, манипулируя необработанным XML и обходя стандартные проверки валидации библиотеки. Использование 1...

CVE-2024-47875-PhpSpreadsheet-XSS-PoC

CVE-2025-22131 • PoC XSS du Writer HTML de PhpSpreadsheet Aperçu Ceci est un PoC sur la CVE-2025-22131 , une vulnérabilité de type Cross-Site Scripting XSS dans les versions de PhpSpreadsheet antérieures à 2.2.2, 2.1.2 et 1.29.4. La vulnérabilité réside dans la fonction generateNavigation, qui ne...

CLSA-2026-1786530064 TuxCare security update for phpoffice/phpspreadsheet (2 CVEs)

TuxCare rebuilt phpoffice/phpspreadsheet to address 2 CVEs. Fixed in 4.5.0-p3+tuxcare...

PT-2026-80104

TuxCare rebuilt phpoffice/phpspreadsheet to address 2 CVEs. Fixed in 4.5.0-p3+tuxcare...

CLSA-2026-1783904633 TuxCare security update for phpoffice/phpspreadsheet (5 CVEs)

TuxCare rebuilt phpoffice/phpspreadsheet to address 5 CVEs. Fixed in 4.5.0-p2+tuxcare...

CLSA-2026-1768525047 TuxCare security update for phpoffice/phpspreadsheet (1 CVE)

TuxCare rebuilt phpoffice/phpspreadsheet to address 1 CVE. Fixed in 4.5.0-p1+tuxcare...

CVE-2026-59932

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the Gnumeric reader reads attacker-supplied .gnumeric files into memory an...

CVE-2026-59933

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the OLE reader follows sector chains from attacker-controlled XLS/OLE...

CVE-2026-59931

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE domain whitelist can be bypassed via an HTTP redirect SSRF...

CVE-2026-59932

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the Gnumeric reader reads attacker-supplied .gnumeric files into memory an...

EUVD-2026-49952

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the Gnumeric reader reads attacker-supplied .gnumeric files into memory an...

CVE-2026-59932 PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the Gnumeric reader reads attacker-supplied .gnumeric files into memory an...

CVE-2026-59932 PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the Gnumeric reader reads attacker-supplied .gnumeric files into memory an...

CVE-2026-59933

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the OLE reader follows sector chains from attacker-controlled XLS/OLE...

CVE-2026-59933

PhpSpreadsheet is affected by a memory-exhaustion denial-of-service in the OLERead::read() path when parsing attacker-controlled XLS/OLE metadata. The vulnerability stems from an unguarded sector-chain walk in the OLE reader that can loop indefinitely (self-loop in small-block depot/sector chains...

CVE-2026-59933 PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the OLE reader follows sector chains from attacker-controlled XLS/OLE...