- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 22 · 11 high, 8 medium
- Registry
- Packagist
Advisories 22
- CVE-2025-23210Medium 4.8
Bypass XSS sanitizer using the javascript protocol and special characters in phpoffice/phpspreadsheet
Affected: through 1.8.2.
- CVE-2025-22131Medium 5.1
Cross-Site Scripting (XSS) vulnerability in generateNavigation() function
Affected: through 1.8.2.
- CVE-2024-56412Medium 4.8
PhpSpreadsheet vulnerable to bypass of the XSS sanitizer using the javascript protocol and special characters
Affected: through 1.8.2.
- CVE-2024-56411Medium 4.8
PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header
Affected: through 1.8.2.
- CVE-2024-56410Medium 4.8
PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability in custom properties
Affected: through 1.8.2.
- CVE-2024-56409High 8.3
PhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php file
Affected: through 1.8.2.
- CVE-2024-56366High 8.3
PhpSpreadsheet vulnerable to unauthorized reflected XSS in the Accounting.php file
Affected: through 1.8.2.
- CVE-2024-56365High 8.3
PhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader class
Affected: through 1.8.2.
- CVE-2024-56408High 8.3
PhpSpreadsheet allows unauthorized reflected XSS in `Convert-Online.php` file
Affected: through 1.8.2.
- CVE-2024-48917High 7.5
XXE in PHPSpreadsheet's XLSX reader
Affected: through 1.8.2.
- CVE-2024-47873High 7.5
PhpSpreadsheet XmlScanner bypass leads to XXE
Affected: through 1.8.2.
- CVE-2024-45060High 7.1
Unauthenticated Cross-Site-Scripting (XSS) in sample file in PHPSpreadsheet
Affected: through 1.8.2.
- CVE-2024-45290High 7.7
Path traversal and Server-Side Request Forgery when opening XLSX files in PHPSpreadsheet
Affected: through 1.8.2.
- CVE-2024-45291Medium 6.3
Path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled in PHPSpreadsheet
Affected: through 1.8.2.
- CVE-2024-45292Medium 5.4
PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks
Affected: through 1.8.2.
Show all 22 advisoriesShow fewer advisories
- CVE-2024-45293High 7.5
XML External Entity Reference (XXE) in PHPSpreadsheet's XLSX reader
Affected: through 1.8.2.
- CVE-2024-45046Medium 5.4
PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information
Affected: through 1.8.2.
- CVE-2024-45048High 8.8
XML External Entity Reference (XXE) in PHPSpreadsheet
Affected: through 1.8.2.
- CVE-2020-7776High 7.1
Cross-site Scripting (XSS)
Affected: through 1.8.2.
- CVE-2019-12331Unrated
PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue.
Affected: through 1.8.2.
- CVE-2018-19277Unrated
securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file
Affected: fixed in 1.8.2.
- CVE-2014-2054Unrated
PHPExcel before 1.8.0, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, does not disable external entity loading in…
Affected: fixed in 1.8.0.