phpoffice/phpspreadsheet vulnerabilities (Packagist)
35 vulnerabilities.
-
phpoffice/phpspreadsheetPackagist PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service 8.8 High -
phpoffice/phpspreadsheetPackagist PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS) 8.7 High -
phpoffice/phpspreadsheetPackagist PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service 8.8 High -
phpoffice/phpspreadsheetPackagist PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading 6.4 Medium -
phpoffice/phpspreadsheetPackagist PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion 7.5 High -
phpoffice/phpspreadsheetPackagist PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion 7.5 High -
phpoffice/phpspreadsheetPackagist PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist 7.7 High -
phpoffice/phpspreadsheetPackagist PhpSpreadsheet: File::prohibitWrappers bypass 9.2 Critical -
phpoffice/phpspreadsheetPackagist PhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions 7.5 High -
phpoffice/phpspreadsheetPackagist PhpSpreadsheet: CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader 7.5 High -
phpoffice/phpspreadsheetPackagist PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load 9.2 Critical -
phpoffice/phpspreadsheetPackagist PhpSpreadsheet vulnerable to XSS in HTML writer via custom number format codes 5.4 Medium -
phpoffice/phpspreadsheetPackagist PhpSpreadsheet XSS via number format text substitution in HTML Writer 4.8 Medium -
phpoffice/phpspreadsheetPackagist PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser 8.7 High -
phpoffice/phpspreadsheetPackagist Bypass XSS sanitizer using the javascript protocol and special characters in phpoffice/phpspreadsheet 4.8 Medium -
phpoffice/phpspreadsheetPackagist Cross-Site Scripting (XSS) vulnerability in generateNavigation() function 5.1 Medium -
phpoffice/phpspreadsheetPackagist PhpSpreadsheet vulnerable to bypass of the XSS sanitizer using the javascript protocol and special characters 4.8 Medium -
phpoffice/phpspreadsheetPackagist PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header 4.8 Medium -
phpoffice/phpspreadsheetPackagist PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability in custom properties 4.8 Medium -
phpoffice/phpspreadsheetPackagist PhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php file 8.3 High -
phpoffice/phpspreadsheetPackagist PhpSpreadsheet vulnerable to unauthorized reflected XSS in the Accounting.php file 8.3 High -
phpoffice/phpspreadsheetPackagist PhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader class 8.3 High -
phpoffice/phpspreadsheetPackagist PhpSpreadsheet allows unauthorized reflected XSS in `Convert-Online.php` file 8.3 High -
phpoffice/phpspreadsheetPackagist XXE in PHPSpreadsheet's XLSX reader 7.5 High -
phpoffice/phpspreadsheetPackagist PhpSpreadsheet XmlScanner bypass leads to XXE 7.5 High -
phpoffice/phpspreadsheetPackagist XML External Entity Reference (XXE) in PHPSpreadsheet's XLSX reader 7.5 High -
phpoffice/phpspreadsheetPackagist PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks 5.4 Medium -
phpoffice/phpspreadsheetPackagist Path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled in PHPSpreadsheet 6.3 Medium -
phpoffice/phpspreadsheetPackagist Path traversal and Server-Side Request Forgery when opening XLSX files in PHPSpreadsheet 7.7 High -
phpoffice/phpspreadsheetPackagist Unauthenticated Cross-Site-Scripting (XSS) in sample file in PHPSpreadsheet 7.1 High -
phpoffice/phpspreadsheetPackagist PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information 5.4 Medium -
phpoffice/phpspreadsheetPackagist XML External Entity Reference (XXE) in PHPSpreadsheet 8.8 High -
phpoffice/phpspreadsheetPackagist Cross-site Scripting (XSS) 7.1 High -
phpoffice/phpspreadsheetPackagist XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue 8.8 High -
phpoffice/phpspreadsheetPackagist XXE in PHPSpreadsheet due to encoding issue 8.8 High