PH
Product
PhpSpreadsheet
33
CVEs
0
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 2High 15Medium 16Low 0
Watch
Add PhpSpreadsheet to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-45048 | 6.5 | Aug 28 | PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files Affected: before 1.29.1; 2.0.0 before 2.2.1 |
| CVE-2026-108360 New | 6.4 | Oct 22 | PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading Affected: < 1.30.7; >= 2.0.0, < 2.1.19; >= 2.2.0, < 2.4.8; >= 3.3.0, < 3.10.8; >= 4.0.0, < 5.10.0 |
| CVE-2020-7776 | 6.4 | Dec 9 | This affects the package phpoffice/phpspreadsheet from 0.0.0 Affected: before 1.16.0 |
| CVE-2025-22131 | 6.1 | Jan 20 | PhpSpreadsheet is a PHP library for reading and writing spreadsheet files Affected: before 1.29.8; 2.0.0 before 2.1.7; 2.2.0 before 2.3.6; 3.0.0 before 3.8.0 |
| CVE-2024-45060 | 6.1 | Oct 7 | PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files Affected: before 1.29.2; 2.0.0 before 2.1.1; 2.2.0 before 2.3.0 |
| CVE-2026-40296 | 5.4 | May 6 | PhpSpreadsheet vulnerable to XSS in HTML writer via custom number format codes Affected: >= 4.0.0, <= 5.6.0; >= 3.3.0, <= 3.10.4; >= 2.2.0, <= 2.4.4; >= 2.0.0, <= 2.1.15; <= 1.30.3 |
| CVE-2026-35453 | 5.4 | May 5 | PhpSpreadsheet XSS via number format text substitution in HTML Writer Affected: >= 4.0.0, <= 5.6.0; >= 3.3.0, <= 3.10.4; >= 2.2.0, <= 2.4.4; >= 2.0.0, <= 2.1.15; <= 1.30.3 |
| CVE-2024-56412 | 5.4 | Jan 3 | PhpSpreadsheet vulnerable to bypass of the XSS sanitizer using the javascript protocol and special characters Affected: >= 3.0.0, < 3.7.0; < 1.29.7; >= 2.0.0, < 2.1.6; >= 2.2.0, < 2.3.5 |
| CVE-2024-56411 | 5.4 | Jan 3 | PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header Affected: >= 3.0.0, < 3.7.0; < 1.29.7; >= 2.0.0, < 2.1.6; >= 2.2.0, < 2.3.5 |
| CVE-2024-56410 | 5.4 | Jan 3 | PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability in custom properties Affected: >= 3.0.0, < 3.7.0; < 1.29.7; >= 2.0.0, < 2.1.6; >= 2.2.0, < 2.3.5 |
| CVE-2024-56409 | 5.4 | Jan 3 | PhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php file Affected: >= 3.0.0, < 3.7.0; < 1.29.7; >= 2.0.0, < 2.1.6; >= 2.2.0, < 2.3.5 |
| CVE-2024-56366 | 5.4 | Jan 3 | PhpSpreadsheet vulnerable to unauthorized reflected XSS in the Accounting.php file Affected: >= 3.0.0, < 3.7.0; < 1.29.7; >= 2.0.0, < 2.1.6; >= 2.2.0, < 2.3.5 |
| CVE-2024-56365 | 5.4 | Jan 3 | PhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader class Affected: >= 3.0.0, < 3.7.0; < 1.29.7; >= 2.0.0, < 2.1.6; >= 2.2.0, < 2.3.5 |
| CVE-2024-56408 | 5.4 | Jan 3 | PhpSpreadsheet allows unauthorized reflected XSS in `Convert-Online.php` file Affected: >= 3.0.0, < 3.7.0; < 1.29.7; >= 2.0.0, < 2.1.6; >= 2.2.0, < 2.3.5 |
| CVE-2024-45292 | 5.4 | Oct 7 | PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files Affected: before 1.29.2; 2.0.0 before 2.1.1; 2.2.0 before 2.3.0 |
| CVE-2024-45046 | 5.4 | Aug 28 | PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files Affected: before 1.29.1; 2.0.0 before 2.1.0 |
Showing 16