phpoffice/phpexcel vulnerabilities (Packagist)

23 vulnerabilities.

• phpoffice/phpexcel Packagist Bypass XSS sanitizer using the javascript protocol and special characters in phpoffice/phpspreadsheet CVE-2025-23210 Fix available 4.8 MediumFebruary 3, 2025
• phpoffice/phpexcel Packagist Cross-Site Scripting (XSS) vulnerability in generateNavigation() function CVE-2025-22131 Public exploitFix available 5.1 MediumJanuary 20, 2025
• phpoffice/phpexcel Packagist PhpSpreadsheet vulnerable to bypass of the XSS sanitizer using the javascript protocol and special characters CVE-2024-56412 Fix available 4.8 MediumJanuary 3, 2025
• phpoffice/phpexcel Packagist PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header CVE-2024-56411 Fix available 4.8 MediumJanuary 3, 2025
• phpoffice/phpexcel Packagist PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability in custom properties CVE-2024-56410 Fix available 4.8 MediumJanuary 3, 2025
• phpoffice/phpexcel Packagist PhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php file CVE-2024-56409 Fix available 8.3 HighJanuary 3, 2025
• phpoffice/phpexcel Packagist PhpSpreadsheet vulnerable to unauthorized reflected XSS in the Accounting.php file CVE-2024-56366 Fix available 8.3 HighJanuary 3, 2025
• phpoffice/phpexcel Packagist PhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader class CVE-2024-56365 Fix available 8.3 HighJanuary 3, 2025
• phpoffice/phpexcel Packagist PhpSpreadsheet allows unauthorized reflected XSS in `Convert-Online.php` file CVE-2024-56408 Fix available 8.3 HighJanuary 3, 2025
• phpoffice/phpexcel Packagist XXE in PHPSpreadsheet's XLSX reader CVE-2024-48917 Fix available 7.5 HighNovember 18, 2024
• phpoffice/phpexcel Packagist PhpSpreadsheet XmlScanner bypass leads to XXE CVE-2024-47873 Fix available 7.5 HighNovember 18, 2024
• phpoffice/phpexcel Packagist PHPExcel XXE Vulnerability CVE-2015-3542 Fix available 8.7 HighNovember 7, 2024
• phpoffice/phpexcel Packagist XML External Entity Reference (XXE) in PHPSpreadsheet's XLSX reader CVE-2024-45293 Fix available 7.5 HighOctober 7, 2024
• phpoffice/phpexcel Packagist PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks CVE-2024-45292 Fix available 5.4 MediumOctober 7, 2024
• phpoffice/phpexcel Packagist Path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled in PHPSpreadsheet CVE-2024-45291 Fix available 6.3 MediumOctober 7, 2024
• phpoffice/phpexcel Packagist Path traversal and Server-Side Request Forgery when opening XLSX files in PHPSpreadsheet CVE-2024-45290 Fix available 7.7 HighOctober 7, 2024
• phpoffice/phpexcel Packagist Unauthenticated Cross-Site-Scripting (XSS) in sample file in PHPSpreadsheet CVE-2024-45060 Fix available 7.1 HighOctober 7, 2024
• phpoffice/phpexcel Packagist PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information CVE-2024-45046 Fix available 5.4 MediumAugust 28, 2024
• phpoffice/phpexcel Packagist XML External Entity Reference (XXE) in PHPSpreadsheet CVE-2024-45048 Fix available 8.8 HighAugust 28, 2024
• phpoffice/phpexcel Packagist Cross-site Scripting (XSS) CVE-2020-7776 Fix available 7.1 HighDecember 9, 2020
• phpoffice/phpexcel Packagist XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue CVE-2019-12331 Fix available 8.8 HighNovember 7, 2019
• phpoffice/phpexcel Packagist XXE in PHPSpreadsheet due to encoding issue CVE-2018-19277 Public exploitFix available 8.8 HighNovember 14, 2018
• phpoffice/phpexcel Packagist PHPExcel vulnerable to XXE attacks through libxml CVE-2014-2054 Fix available 7.5 HighJune 4, 2014