phpoffice/phpspreadsheet (Packagist)
Advisories
130
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 5.10.0 or later clears every advisory below that has a fix.
Upgrade commands
composer
composer require phpoffice/phpspreadsheet:^5.10.0Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-2phh-27fw-q4gc PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading |
Medium EPSS 0.34% |
< 1.30.7 | 1.30.7 |
| GHSA-2phh-27fw-q4gc PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading |
Medium EPSS 0.34% |
>= 4.0.0, < 5.10.0 | 5.10.0 |
| GHSA-2phh-27fw-q4gc PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading |
Medium EPSS 0.34% |
>= 3.3.0, < 3.10.8 | 3.10.8 |
| GHSA-2phh-27fw-q4gc PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading |
Medium EPSS 0.34% |
>= 2.2.0, < 2.4.8 | 2.4.8 |
| GHSA-2phh-27fw-q4gc PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading |
Medium EPSS 0.34% |
>= 2.0.0, < 2.1.19 | 2.1.19 |
| GHSA-j2w7-387v-m2rq PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS) |
High EPSS 0.66% |
< 1.30.7 | 1.30.7 |
| GHSA-j2w7-387v-m2rq PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS) |
High EPSS 0.66% |
>= 2.0.0, < 2.1.19 | 2.1.19 |
| GHSA-j2w7-387v-m2rq PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS) |
High EPSS 0.66% |
>= 2.2.0, < 2.4.8 | 2.4.8 |
| GHSA-j2w7-387v-m2rq PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS) |
High EPSS 0.66% |
>= 3.3.0, < 3.10.8 | 3.10.8 |
| GHSA-j2w7-387v-m2rq PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS) |
High EPSS 0.66% |
>= 4.0.0, < 5.10.0 | 5.10.0 |
| GHSA-3x94-m842-937c PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service |
High EPSS 0.62% |
>= 4.0.0, < 5.10.0 | 5.10.0 |
| GHSA-3x94-m842-937c PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service |
High EPSS 0.62% |
>= 3.3.0, < 3.10.8 | 3.10.8 |
| GHSA-3x94-m842-937c PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service |
High EPSS 0.62% |
>= 2.2.0, < 2.4.8 | 2.4.8 |
| GHSA-3x94-m842-937c PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service |
High EPSS 0.62% |
>= 2.0.0, < 2.1.19 | 2.1.19 |
| GHSA-3x94-m842-937c PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service |
High EPSS 0.62% |
< 1.30.7 | 1.30.7 |
| GHSA-rxj4-h86g-25gc PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service |
High EPSS 0.46% |
>= 3.3.0, < 3.10.8 | 3.10.8 |
| GHSA-rxj4-h86g-25gc PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service |
High EPSS 0.46% |
>= 4.0.0, < 5.10.0 | 5.10.0 |
| GHSA-xh5m-36r6-47m3 PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion |
High EPSS 0.46% |
>= 2.2.0, < 2.4.7 | 2.4.7 |
| GHSA-xh5m-36r6-47m3 PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion |
High EPSS 0.46% |
>= 3.3.0, < 3.10.7 | 3.10.7 |
| GHSA-xh5m-36r6-47m3 PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion |
High EPSS 0.46% |
>= 4.0.0, < 5.8.1 | 5.8.1 |
| GHSA-xh5m-36r6-47m3 PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion |
High EPSS 0.46% |
< 1.30.6 | 1.30.6 |
| GHSA-xh5m-36r6-47m3 PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion |
High EPSS 0.46% |
>= 2.0.0, < 2.1.18 | 2.1.18 |
| GHSA-2mrg-gjxq-2gvr PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion |
High EPSS 0.46% |
>= 3.3.0, < 3.10.7 | 3.10.7 |
| GHSA-2mrg-gjxq-2gvr PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion |
High EPSS 0.46% |
>= 2.0.0, < 2.1.18 | 2.1.18 |
| GHSA-2mrg-gjxq-2gvr PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion |
High EPSS 0.46% |
< 1.30.6 | 1.30.6 |
| GHSA-2mrg-gjxq-2gvr PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion |
High EPSS 0.46% |
>= 4.0.0, < 5.8.1 | 5.8.1 |
| GHSA-2mrg-gjxq-2gvr PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion |
High EPSS 0.46% |
>= 2.2.0, < 2.4.7 | 2.4.7 |
| GHSA-6hq5-7373-42rg PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist |
High EPSS 0.47% |
< 1.30.6 | 1.30.6 |
| GHSA-6hq5-7373-42rg PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist |
High EPSS 0.47% |
>= 4.0.0, < 5.8.1 | 5.8.1 |
| GHSA-6hq5-7373-42rg PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist |
High EPSS 0.47% |
>= 3.3.0, < 3.10.7 | 3.10.7 |
| GHSA-6hq5-7373-42rg PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist |
High EPSS 0.47% |
>= 2.2.0, < 2.4.7 | 2.4.7 |
| GHSA-6hq5-7373-42rg PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist |
High EPSS 0.47% |
>= 2.0.0, < 2.1.18 | 2.1.18 |
| GHSA-87m4-826x-3crx PHPSpreadsheet has a patch bypass for CVE-2026-34084 |
Critical EPSS 0.46% |
< 1.30.5 | 1.30.5 |
| GHSA-7c6m-4442-2x6m PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions |
High EPSS 0.40% |
>= 4.0.0, < 5.7.0 | 5.7.0 |
| GHSA-7c6m-4442-2x6m PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions |
High EPSS 0.40% |
>= 3.3.0, < 3.10.5 | 3.10.5 |
| GHSA-7c6m-4442-2x6m PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions |
High EPSS 0.40% |
< 1.30.4 | 1.30.4 |
| GHSA-7c6m-4442-2x6m PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions |
High EPSS 0.40% |
>= 2.0.0, < 2.1.16 | 2.1.16 |
| GHSA-7c6m-4442-2x6m PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions |
High EPSS 0.40% |
>= 2.2.0, < 2.4.5 | 2.4.5 |
| GHSA-84wq-86v6-x5j6 PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader |
High EPSS 0.40% |
>= 4.0.0, < 5.7.0 | 5.7.0 |
| GHSA-84wq-86v6-x5j6 PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader |
High EPSS 0.40% |
< 1.30.6 | 1.30.6 |
| GHSA-84wq-86v6-x5j6 PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader |
High EPSS 0.40% |
>= 2.0.0, < 2.1.16 | 2.1.16 |
| GHSA-84wq-86v6-x5j6 PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader |
High EPSS 0.40% |
>= 2.2.0, < 2.4.5 | 2.4.5 |
| GHSA-84wq-86v6-x5j6 PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader |
High EPSS 0.40% |
>= 3.3.0, < 3.10.5 | 3.10.5 |
| GHSA-q4q6-r8wh-5cgh PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled |
Critical EPSS 0.71% |
>= 4.0.0, < 5.6.0 | 5.6.0 |
| GHSA-q4q6-r8wh-5cgh PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled |
Critical EPSS 0.71% |
>= 3.3.0, < 3.10.4 | 3.10.4 |
| GHSA-q4q6-r8wh-5cgh PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled |
Critical EPSS 0.71% |
>= 2.2.0, < 2.4.4 | 2.4.4 |
| GHSA-q4q6-r8wh-5cgh PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled |
Critical EPSS 0.71% |
>= 2.0.0, < 2.1.15 | 2.1.15 |
| GHSA-q4q6-r8wh-5cgh PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled |
Critical EPSS 0.71% |
< 1.30.3 | 1.30.3 |
| GHSA-hrmw-qprp-wgmc PhpSpreadsheet has XSS via number format code with @ text placeholder bypasses htmlspecialchars in HTML writer |
Medium EPSS 0.22% |
>= 4.0.0, < 5.7.0 | 5.7.0 |
| GHSA-hrmw-qprp-wgmc PhpSpreadsheet has XSS via number format code with @ text placeholder bypasses htmlspecialchars in HTML writer |
Medium EPSS 0.22% |
< 1.30.4 | 1.30.4 |
| GHSA-hrmw-qprp-wgmc PhpSpreadsheet has XSS via number format code with @ text placeholder bypasses htmlspecialchars in HTML writer |
Medium EPSS 0.22% |
>= 2.0.0, < 2.1.16 | 2.1.16 |
| GHSA-hrmw-qprp-wgmc PhpSpreadsheet has XSS via number format code with @ text placeholder bypasses htmlspecialchars in HTML writer |
Medium EPSS 0.22% |
>= 2.2.0, < 2.4.5 | 2.4.5 |
| GHSA-hrmw-qprp-wgmc PhpSpreadsheet has XSS via number format code with @ text placeholder bypasses htmlspecialchars in HTML writer |
Medium EPSS 0.22% |
>= 3.3.0, < 3.10.5 | 3.10.5 |
| GHSA-6wpp-88cp-7q68 PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer |
Medium EPSS 0.20% |
>= 3.3.0, < 3.10.5 | 3.10.5 |
| GHSA-6wpp-88cp-7q68 PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer |
Medium EPSS 0.20% |
< 1.30.4 | 1.30.4 |
| GHSA-6wpp-88cp-7q68 PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer |
Medium EPSS 0.20% |
>= 2.0.0, < 2.1.16 | 2.1.16 |
| GHSA-6wpp-88cp-7q68 PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer |
Medium EPSS 0.20% |
>= 2.2.0, < 2.4.5 | 2.4.5 |
| GHSA-6wpp-88cp-7q68 PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer |
Medium EPSS 0.20% |
>= 4.0.0, < 5.7.0 | 5.7.0 |
| GHSA-rx7m-68vc-ppxh PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser |
High EPSS 0.82% |
< 1.30.0 | 1.30.0 |
| GHSA-rx7m-68vc-ppxh PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser |
High EPSS 0.82% |
>= 4.0.0, < 5.0.0 | 5.0.0 |
| GHSA-rx7m-68vc-ppxh PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser |
High EPSS 0.82% |
>= 3.0.0, < 3.10.0 | 3.10.0 |
| GHSA-rx7m-68vc-ppxh PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser |
High EPSS 0.82% |
>= 2.2.0, < 2.4.0 | 2.4.0 |
| GHSA-rx7m-68vc-ppxh PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser |
High EPSS 0.82% |
>= 2.0.0, < 2.1.12 | 2.1.12 |
| GHSA-r57h-547h-w24f PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters |
Medium EPSS 0.41% |
>= 2.0.0, < 2.1.8 | 2.1.8 |
| GHSA-r57h-547h-w24f PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters |
Medium EPSS 0.41% |
>= 2.2.0, < 2.3.7 | 2.3.7 |
| GHSA-r57h-547h-w24f PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters |
Medium EPSS 0.41% |
< 1.29.9 | 1.29.9 |
| GHSA-r57h-547h-w24f PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters |
Medium EPSS 0.41% |
>= 3.0.0, < 3.9.0 | 3.9.0 |
| GHSA-79xx-vf93-p7cx Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet |
Medium EPSS 0.40% |
>= 2.2.0, < 2.3.6 | 2.3.6 |
| GHSA-79xx-vf93-p7cx Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet |
Medium EPSS 0.40% |
>= 2.0.0, < 2.1.7 | 2.1.7 |
| GHSA-79xx-vf93-p7cx Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet |
Medium EPSS 0.40% |
< 1.29.8 | 1.29.8 |
| GHSA-79xx-vf93-p7cx Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet |
Medium EPSS 0.40% |
>= 3.0.0, < 3.8.0 | 3.8.0 |
| GHSA-q9jv-mm3r-j47r PhpSpreadsheet allows bypass XSS sanitizer using the javascript protocol and special characters |
Medium EPSS 0.39% |
>= 2.0.0, < 2.1.6 | 2.1.6 |
| GHSA-q9jv-mm3r-j47r PhpSpreadsheet allows bypass XSS sanitizer using the javascript protocol and special characters |
Medium EPSS 0.39% |
>= 3.0.0, < 3.7.0 | 3.7.0 |
| GHSA-q9jv-mm3r-j47r PhpSpreadsheet allows bypass XSS sanitizer using the javascript protocol and special characters |
Medium EPSS 0.39% |
< 1.29.7 | 1.29.7 |
| GHSA-q9jv-mm3r-j47r PhpSpreadsheet allows bypass XSS sanitizer using the javascript protocol and special characters |
Medium EPSS 0.39% |
>= 2.2.0, < 2.3.5 | 2.3.5 |
| GHSA-hwcp-2h35-p66w PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header |
Medium EPSS 0.37% |
< 1.29.7 | 1.29.7 |
| GHSA-hwcp-2h35-p66w PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header |
Medium EPSS 0.37% |
>= 2.2.0, < 2.3.5 | 2.3.5 |
| GHSA-hwcp-2h35-p66w PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header |
Medium EPSS 0.37% |
>= 2.0.0, < 2.1.6 | 2.1.6 |
| GHSA-hwcp-2h35-p66w PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header |
Medium EPSS 0.37% |
>= 3.0.0, < 3.7.0 | 3.7.0 |
| GHSA-wv23-996v-q229 PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability in custom properties |
Medium EPSS 0.34% |
>= 2.0.0, < 2.1.6 | 2.1.6 |
| GHSA-wv23-996v-q229 PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability in custom properties |
Medium EPSS 0.34% |
>= 2.2.0, < 2.3.5 | 2.3.5 |
| GHSA-wv23-996v-q229 PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability in custom properties |
Medium EPSS 0.34% |
>= 3.0.0, < 3.7.0 | 3.7.0 |
| GHSA-wv23-996v-q229 PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability in custom properties |
Medium EPSS 0.34% |
< 1.29.7 | 1.29.7 |
| GHSA-j2xg-cjcx-4677 PhpSpreadsheet allows unauthorized Reflected XSS in Currency.php file |
Medium EPSS 0.34% |
>= 2.2.0, < 2.3.5 | 2.3.5 |
| GHSA-j2xg-cjcx-4677 PhpSpreadsheet allows unauthorized Reflected XSS in Currency.php file |
Medium EPSS 0.34% |
>= 2.0.0, < 2.1.6 | 2.1.6 |
| GHSA-j2xg-cjcx-4677 PhpSpreadsheet allows unauthorized Reflected XSS in Currency.php file |
Medium EPSS 0.34% |
< 1.29.7 | 1.29.7 |
| GHSA-j2xg-cjcx-4677 PhpSpreadsheet allows unauthorized Reflected XSS in Currency.php file |
Medium EPSS 0.34% |
>= 3.0.0, < 3.7.0 | 3.7.0 |
| GHSA-c6fv-7vh8-2rhr PhpSpreadsheet allows unauthorized Reflected XSS in the Accounting.php file |
Medium EPSS 0.34% |
>= 2.0.0, < 2.1.6 | 2.1.6 |
| GHSA-c6fv-7vh8-2rhr PhpSpreadsheet allows unauthorized Reflected XSS in the Accounting.php file |
Medium EPSS 0.34% |
>= 3.0.0, < 3.7.0 | 3.7.0 |
| GHSA-c6fv-7vh8-2rhr PhpSpreadsheet allows unauthorized Reflected XSS in the Accounting.php file |
Medium EPSS 0.34% |
< 1.29.7 | 1.29.7 |
| GHSA-c6fv-7vh8-2rhr PhpSpreadsheet allows unauthorized Reflected XSS in the Accounting.php file |
Medium EPSS 0.34% |
>= 2.2.0, < 2.3.5 | 2.3.5 |
| GHSA-jmpx-686v-c3wx PhpSpreadsheet allows unauthorized Reflected XSS in the constructor of the Downloader class |
Medium EPSS 0.33% |
>= 3.0.0, < 3.7.0 | 3.7.0 |
| GHSA-jmpx-686v-c3wx PhpSpreadsheet allows unauthorized Reflected XSS in the constructor of the Downloader class |
Medium EPSS 0.33% |
>= 2.2.0, < 2.3.5 | 2.3.5 |
| GHSA-jmpx-686v-c3wx PhpSpreadsheet allows unauthorized Reflected XSS in the constructor of the Downloader class |
Medium EPSS 0.33% |
>= 2.0.0, < 2.1.6 | 2.1.6 |
| GHSA-jmpx-686v-c3wx PhpSpreadsheet allows unauthorized Reflected XSS in the constructor of the Downloader class |
Medium EPSS 0.33% |
< 1.29.7 | 1.29.7 |
| GHSA-x88g-h956-m5xg PhpSpreadsheet allows unauthorized Reflected XSS in `Convert-Online.php` file |
Medium EPSS 0.41% |
>= 2.2.0, < 2.3.5 | 2.3.5 |
| GHSA-x88g-h956-m5xg PhpSpreadsheet allows unauthorized Reflected XSS in `Convert-Online.php` file |
Medium EPSS 0.41% |
>= 2.0.0, < 2.1.6 | 2.1.6 |
| GHSA-x88g-h956-m5xg PhpSpreadsheet allows unauthorized Reflected XSS in `Convert-Online.php` file |
Medium EPSS 0.41% |
< 1.29.7 | 1.29.7 |
| GHSA-x88g-h956-m5xg PhpSpreadsheet allows unauthorized Reflected XSS in `Convert-Online.php` file |
Medium EPSS 0.41% |
>= 3.0.0, < 3.7.0 | 3.7.0 |
| GHSA-7cc9-j4mv-vcjp XXE in PHPSpreadsheet's XLSX reader |
High EPSS 0.73% |
>= 2.0.0, < 2.1.3 | 2.1.3 |
| GHSA-7cc9-j4mv-vcjp XXE in PHPSpreadsheet's XLSX reader |
High EPSS 0.73% |
>= 3.3.0, < 3.4.0 | 3.4.0 |
| GHSA-7cc9-j4mv-vcjp XXE in PHPSpreadsheet's XLSX reader |
High EPSS 0.73% |
< 1.29.4 | 1.29.4 |
| GHSA-7cc9-j4mv-vcjp XXE in PHPSpreadsheet's XLSX reader |
High EPSS 0.73% |
>= 2.2.0, < 2.3.2 | 2.3.2 |
| GHSA-jw4x-v69f-hh5w XmlScanner bypass leads to XXE |
High EPSS 0.76% |
< 1.29.4 | 1.29.4 |
| GHSA-jw4x-v69f-hh5w XmlScanner bypass leads to XXE |
High EPSS 0.76% |
>= 2.0.0, < 2.1.3 | 2.1.3 |
| GHSA-jw4x-v69f-hh5w XmlScanner bypass leads to XXE |
High EPSS 0.76% |
>= 2.2.0, < 2.3.2 | 2.3.2 |
| GHSA-jw4x-v69f-hh5w XmlScanner bypass leads to XXE |
High EPSS 0.76% |
>= 3.3.0, < 3.4.0 | 3.4.0 |
| GHSA-6hwr-6v2f-3m88 XXE in PHPSpreadsheet's XLSX reader |
High EPSS 2.78% |
< 1.29.1 | 1.29.1 |
| GHSA-6hwr-6v2f-3m88 XXE in PHPSpreadsheet's XLSX reader |
High EPSS 2.78% |
>= 2.2.0, < 2.3.0 | 2.3.0 |
| GHSA-6hwr-6v2f-3m88 XXE in PHPSpreadsheet's XLSX reader |
High EPSS 2.78% |
>= 2.0.0, < 2.1.1 | 2.1.1 |
| GHSA-r8w8-74ww-j4wh PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks |
Medium EPSS 0.34% |
>= 2.0.0, < 2.1.1 | 2.1.1 |
| GHSA-r8w8-74ww-j4wh PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks |
Medium EPSS 0.34% |
>= 2.2.0, < 2.3.0 | 2.3.0 |
| GHSA-r8w8-74ww-j4wh PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks |
Medium EPSS 0.34% |
< 1.29.2 | 1.29.2 |
| GHSA-w9xv-qf98-ccq4 PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled |
High EPSS 0.86% |
>= 2.2.0, < 2.3.0 | 2.3.0 |
| GHSA-w9xv-qf98-ccq4 PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled |
High EPSS 0.86% |
>= 2.0.0, < 2.1.1 | 2.1.1 |
| GHSA-w9xv-qf98-ccq4 PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled |
High EPSS 0.86% |
< 1.29.2 | 1.29.2 |
| GHSA-5gpr-w2p5-6m37 PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery when opening XLSX file |
High EPSS 0.62% |
>= 2.0.0, < 2.1.1 | 2.1.1 |
| GHSA-5gpr-w2p5-6m37 PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery when opening XLSX file |
High EPSS 0.62% |
< 1.29.2 | 1.29.2 |
| GHSA-5gpr-w2p5-6m37 PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery when opening XLSX file |
High EPSS 0.62% |
>= 2.2.0, < 2.3.0 | 2.3.0 |
| GHSA-v66g-p9x6-v98p PhpSpreadsheet has an Unauthenticated Cross-Site-Scripting (XSS) in sample file |
Medium EPSS 0.51% |
>= 2.2.0, < 2.3.0 | 2.3.0 |
| GHSA-v66g-p9x6-v98p PhpSpreadsheet has an Unauthenticated Cross-Site-Scripting (XSS) in sample file |
Medium EPSS 0.51% |
< 1.29.2 | 1.29.2 |
| GHSA-v66g-p9x6-v98p PhpSpreadsheet has an Unauthenticated Cross-Site-Scripting (XSS) in sample file |
Medium EPSS 0.51% |
>= 2.0.0, < 2.1.1 | 2.1.1 |
| GHSA-ghg6-32f9-2jp7 XXE in PHPSpreadsheet encoding is returned |
Medium EPSS 0.60% |
< 1.29.1 | 1.29.1 |
| GHSA-ghg6-32f9-2jp7 XXE in PHPSpreadsheet encoding is returned |
Medium EPSS 0.60% |
>= 2.0.0, < 2.1.1 | 2.1.1 |
| GHSA-ghg6-32f9-2jp7 XXE in PHPSpreadsheet encoding is returned |
Medium EPSS 0.60% |
>= 2.2.0, < 2.2.1 | 2.2.1 |
| GHSA-wgmf-q9vr-vww6 PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information |
Medium EPSS 0.42% |
< 1.29.1 | 1.29.1 |
| GHSA-wgmf-q9vr-vww6 PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information |
Medium EPSS 0.42% |
>= 2.0.0, < 2.1.0 | 2.1.0 |
| GHSA-4mqv-gcr3-pff9 Cross-site scripting in phpoffice/phpspreadsheet |
Medium EPSS 1.32% |
< 1.16.0 | 1.16.0 |
| GHSA-vvwv-h69m-wg6f XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue |
High EPSS 1.35% |
< 1.8.0 | 1.8.0 |
| GHSA-xcrg-29h7-h4cj XXE in PHPSpreadsheet due to encoding issue |
High EPSS 7.79% |
< 1.5.1 | 1.5.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor