https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 13:00:43 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-01639 bdu:2025-01639 https://cve.radiocsirt.org/vuln/bdu:2025-01639 https://cve.radiocsirt.org/vuln/euvd-2026-211161 EUVD-2026-211161 https://cve.radiocsirt.org/vuln/euvd-2026-211161 https://cve.radiocsirt.org/vuln/fkie_cve-2025-22131 <p>PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Cross-Site Scripting (XSS) vulnerability in the code which translates the XLSX file into a HTML representation and displays it in the response.</p> <p>PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Cross-Site Scripting (XSS) vulnerability in the code which translates the XLSX file into a HTML representation and displays it in the response.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-22131 https://cve.radiocsirt.org/vuln/ghsa-79xx-vf93-p7cx <p><strong>Affected:</strong> Packagist: phpoffice/phpspreadsheet, Packagist: phpoffice/phpexcel</p> <p>### Summary The researcher discovered zero-day vulnerability Cross-Site Scripting (XSS) vulnerability in the code which translates the XLSX file into a HTML representation and displays it in the response.</p> <p>### Details When generating the HTML from an xlsx file containing multiple sheets, a navigation menu is created. This menu includes the sheet names, which are not sanitized. As a result, an attacker can exploit this vulnerability to execute JavaScript code.</p> <p>```php // Construct HTML $html = &#39;&#39;;</p> <p>// Only if there are more than 1 sheets if (count($sheets) &gt; 1) { // Loop all sheets $sheetId = 0;</p> <p>$html .= &#39;&lt;ul class=&#34;navigation&#34;&gt;&#39; . PHP_EOL;</p> <p>foreach ($sheets as $sheet) { $html .= &#39; &lt;li class=&#34;sheet&#39; . $sheetId . &#39;&#34;&gt;&lt;a href=&#34;#sheet&#39; . $sheetId . &#39;&#34;&gt;&#39; . $sheet-&gt;getTitle() . &#39;&lt;/a&gt;&lt;/li&gt;&#39; . PHP_EOL; ++$sheetId; }</p> <p>$html .= &#39;&lt;/ul&gt;&#39; . PHP_EOL; } ```</p> <p>### PoC 1. Create an XLSX file with multiple sheets : </p> <p>2. Generate the HTML content ```php &lt;?php require __DIR__ . &#39;/vendor/autoload.php&#39;;</p> <p>$inputFileName = &#39;payload.xlsx&#39;; $spreadsheet = \PhpOffice\PhpSpreadsheet\IOFactory::load($inputFileName); $writer = new \PhpOffice\PhpSpreadsheet\Writer\Html($spreadsheet); $writer-&gt;writeAllSheets(); echo $writer-&gt;generateHTMLAll(); ?&gt; ``` 3. Enjoy  vulnerability in the code which translates the XLSX file into a HTML representation and displays it in the response.</p> <p>### Details When generating the HTML from an xlsx file containing multiple sheets, a navigation menu is created. This menu includes the sheet names, which are not sanitized. As a result, an attacker can exploit this vulnerability to execute JavaScript code.</p> <p>```php // Construct HTML $html = &#39;&#39;;</p> <p>// Only if there are more than 1 sheets if (count($sheets) &gt; 1) { // Loop all sheets $sheetId = 0;</p> <p>$html .= &#39;&lt;ul class=&#34;navigation&#34;&gt;&#39; . PHP_EOL;</p> <p>foreach ($sheets as $sheet) { $html .= &#39; &lt;li class=&#34;sheet&#39; . $sheetId . &#39;&#34;&gt;&lt;a href=&#34;#sheet&#39; . $sheetId . &#39;&#34;&gt;&#39; . $sheet-&gt;getTitle() . &#39;&lt;/a&gt;&lt;/li&gt;&#39; . PHP_EOL; ++$sheetId; }</p> <p>$html .= &#39;&lt;/ul&gt;&#39; . PHP_EOL; } ```</p> <p>### PoC 1. Create an XLSX file with multiple sheets : </p> <p>2. Generate the HTML content ```php &lt;?php require __DIR__ . &#39;/vendor/autoload.php&#39;;</p> <p>$inputFileName = &#39;payload.xlsx&#39;; $spreadsheet = \PhpOffice\PhpSpreadsheet\IOFactory::load($inputFileName); $writer = new \PhpOffice\PhpSpreadsheet\Writer\Html($spreadsheet); $writer-&gt;writeAllSheets(); echo $writer-&gt;generateHTMLAll(); ?&gt; ``` 3. Enjoy ![image](h…</p> https://cve.radiocsirt.org/vuln/ghsa-79xx-vf93-p7cx