PH
Vendor
PHPOffice
35
CVEs
0
On KEV
6
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-108357 New | PH PhpSpreadsheet PHPOffice | 8.8 | Oct 22 | PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service |
| CVE-2026-108359 New | PH PhpSpreadsheet PHPOffice | 8.7 | Oct 22 | PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS) |
| CVE-2026-108358 New | PH PhpSpreadsheet PHPOffice | 8.8 | Oct 22 | PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service |
| CVE-2026-108360 New | PH PhpSpreadsheet PHPOffice | 6.4 | Oct 22 | PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading |
| CVE-2026-114404 | PH PHPPresentation PHPOffice | 6.1 | Oct 21 | PHPPresentation 1.2.0 XSS via Writer\HTML Text Runs, Hyperlinks and Descriptions |
| CVE-2026-114403 | PH PHPPresentation PHPOffice | 8.1 | Oct 21 | PHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\Serialized::load |
| CVE-2026-59932 | PH PhpSpreadsheet PHPOffice | 7.5 | Jul 28 | PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion |
| CVE-2026-59933 | PH PhpSpreadsheet PHPOffice | 7.5 | Jul 28 | PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion |
| CVE-2026-59931 | PH PhpSpreadsheet PHPOffice | 7.7 | Jul 28 | PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist |
| CVE-2026-45034 | PH PhpSpreadsheet PHPOffice | 9.2 | Jun 22 | PhpSpreadsheet: File::prohibitWrappers bypass |
| CVE-2026-40863 | PH PhpSpreadsheet PHPOffice | 7.5 | May 12 | PhpSpreadsheet: CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader |
| CVE-2026-40902 | PH PhpSpreadsheet PHPOffice | 7.5 | May 12 | PhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions |
| CVE-2026-40296 | PH PhpSpreadsheet PHPOffice | 5.4 | May 6 | PhpSpreadsheet vulnerable to XSS in HTML writer via custom number format codes |
| CVE-2026-35453 | PH PhpSpreadsheet PHPOffice | 5.4 | May 5 | PhpSpreadsheet XSS via number format text substitution in HTML Writer |
| CVE-2026-34084 | PH PhpSpreadsheet PHPOffice | 9.8 | May 5 | PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load |
| CVE-2025-22131 | PH Phpspreadsheet Phpoffice | 6.1 | Jan 20 | PhpSpreadsheet is a PHP library for reading and writing spreadsheet files |
| CVE-2024-56412 | PH PhpSpreadsheet PHPOffice | 5.4 | Jan 3 | PhpSpreadsheet vulnerable to bypass of the XSS sanitizer using the javascript protocol and special characters |
| CVE-2024-56411 | PH PhpSpreadsheet PHPOffice | 5.4 | Jan 3 | PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header |
| CVE-2024-56410 | PH PhpSpreadsheet PHPOffice | 5.4 | Jan 3 | PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability in custom properties |
| CVE-2024-56409 | PH PhpSpreadsheet PHPOffice | 5.4 | Jan 3 | PhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php file |
| CVE-2024-56366 | PH PhpSpreadsheet PHPOffice | 5.4 | Jan 3 | PhpSpreadsheet vulnerable to unauthorized reflected XSS in the Accounting.php file |
| CVE-2024-56365 | PH PhpSpreadsheet PHPOffice | 5.4 | Jan 3 | PhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader class |
| CVE-2024-56408 | PH PhpSpreadsheet PHPOffice | 5.4 | Jan 3 | PhpSpreadsheet allows unauthorized reflected XSS in `Convert-Online.php` file |
| CVE-2024-48917 | PH Phpspreadsheet Phpoffice | 7.5 | Nov 18 | PhpSpreadsheet is a PHP library for reading and writing spreadsheet files |
| CVE-2024-47873 | PH Phpspreadsheet Phpoffice | 7.5 | Nov 18 | PhpSpreadsheet is a PHP library for reading and writing spreadsheet files |
| CVE-2024-45291 | PH Phpspreadsheet Phpoffice | 8.8 | Oct 7 | PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files |
| CVE-2024-45290 | PH Phpspreadsheet Phpoffice | 7.5 | Oct 7 | PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files |
| CVE-2024-45060 | PH Phpspreadsheet Phpoffice | 6.1 | Oct 7 | PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files |
| CVE-2024-45293 | PH Phpspreadsheet Phpoffice | 7.5 | Oct 7 | PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files |
| CVE-2024-45292 | PH Phpspreadsheet Phpoffice | 5.4 | Oct 7 | PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files |
| CVE-2024-45048 | PH Phpspreadsheet Phpoffice | 6.5 | Aug 28 | PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files |
| CVE-2024-45046 | PH Phpspreadsheet Phpoffice | 5.4 | Aug 28 | PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files |
| CVE-2020-7776 | PH Phpspreadsheet Phpoffice | 6.4 | Dec 9 | This affects the package phpoffice/phpspreadsheet from 0.0.0 |
| CVE-2019-12331 | PH Phpspreadsheet Phpoffice | 8.8 | Nov 7 | PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue |
| CVE-2018-19277 | PH Phpspreadsheet Phpoffice | 8.8 | Nov 14 | securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file |