https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T19:45:00.862262+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-00506 bdu:2025-00506 2026-10-16T19:45:00.865928+00:00 bdu:2025-00506 https://cve.radiocsirt.org/vuln/euvd-2026-240393 EUVD-2026-240393 2026-10-16T19:45:00.865962+00:00 EUVD-2026-240393 https://cve.radiocsirt.org/vuln/fkie_cve-2024-56408 fkie_cve-2024-56408 2026-10-16T19:45:00.865976+00:00

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have no sanitization in the `/vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.php` file, which leads to the possibility of a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.

 https://cve.radiocsirt.org/vuln/ghsa-x88g-h956-m5xg GHSA-x88g-h956-m5xg — PhpSpreadsheet allows unauthorized Reflected XSS in `Convert-Online.php` file 2026-10-16T19:45:00.866003+00:00

Affected: Packagist: phpoffice/phpspreadsheet, Packagist: phpoffice/phpexcel

# Unauthorized Reflected XSS in `Convert-Online.php` file **Product**: Phpspreadsheet **Version**: version 3.6.0 **CWE-ID**: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') **CVSS vector v.3.1**: 8.2 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N) **CVSS vector v.4.0**: 8.3 (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L) **Description**: using the `/vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.php` script, an attacker can perform a XSS-type attack **Impact**: executing arbitrary JavaScript code in the browser **Vulnerable component**: the `/vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.php` file **Exploitation conditions**: an unauthorized user **Mitigation**: sanitization of the quantity variable **Researcher**: Aleksey Solovev (Positive Technologies)

# Research

The researcher discovered zero-day vulnerability Unauthorized Reflected Cross-Site Scripting (XSS) (in `Convert-Online.php` file) in Phpspreadsheet.

There is no sanitization in the `/vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.php` file, which leads to the possibility of a XSS attack.

![fig4](https://github.com/user-attachments/assets/71a6ab8b-db65-4e7e-bb36-39f0bd0f7077)

*Figure 4. The message with the quantity parameter is displayed without sanitization*

The following figure shows a POST HTTP-request and a response to the server with the variable quantity, which is displayed in the response from th…