https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T11:06:10.079348+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2024-56412 CVE-2024-56412 — PhpSpreadsheet vulnerable to bypass of the XSS sanitizer using the javascript protocol and special characters 2026-10-07T11:06:10.099926+00:00

Affected: PHPOffice PhpSpreadsheet

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to bypass of the cross-site scripting sanitizer using the javascript protocol and special characters. An attacker can use special characters, so that the library processes the javascript protocol with special characters and generates an HTML link. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.