https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 18:50:47 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-00506 bdu:2025-00506 https://cve.radiocsirt.org/vuln/bdu:2025-00506 https://cve.radiocsirt.org/vuln/euvd-2026-240393 EUVD-2026-240393 https://cve.radiocsirt.org/vuln/euvd-2026-240393 https://cve.radiocsirt.org/vuln/fkie_cve-2024-56408 <p>PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have no sanitization in the `/vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.php` file, which leads to the possibility of a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.</p> <p>PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have no sanitization in the `/vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.php` file, which leads to the possibility of a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-56408 https://cve.radiocsirt.org/vuln/ghsa-x88g-h956-m5xg <p><strong>Affected:</strong> Packagist: phpoffice/phpspreadsheet, Packagist: phpoffice/phpexcel</p> <p># Unauthorized Reflected XSS in `Convert-Online.php` file **Product**: Phpspreadsheet **Version**: version 3.6.0 **CWE-ID**: CWE-79: Improper Neutralization of Input During Web Page Generation (&#39;Cross-site Scripting&#39;) **CVSS vector v.3.1**: 8.2 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N) **CVSS vector v.4.0**: 8.3 (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L) **Description**: using the `/vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.php` script, an attacker can perform a XSS-type attack **Impact**: executing arbitrary JavaScript code in the browser **Vulnerable component**: the `/vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.php` file **Exploitation conditions**: an unauthorized user **Mitigation**: sanitization of the quantity variable **Researcher**: Aleksey Solovev (Positive Technologies)</p> <p># Research</p> <p>The researcher discovered zero-day vulnerability Unauthorized Reflected Cross-Site Scripting (XSS) (in `Convert-Online.php` file) in Phpspreadsheet.</p> <p>There is no sanitization in the `/vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.php` file, which leads to the possibility of a XSS attack.</p> <p></p> <p>*Figure 4. The message with the quantity parameter is displayed without sanitization*</p> <p>The following figure shows a POST HTTP-request and a response to the server with the variable quantity, which is displayed in the response from th…</p> <p><strong>Affected:</strong> Packagist: phpoffice/phpspreadsheet, Packagist: phpoffice/phpexcel</p> <p># Unauthorized Reflected XSS in `Convert-Online.php` file **Product**: Phpspreadsheet **Version**: version 3.6.0 **CWE-ID**: CWE-79: Improper Neutralization of Input During Web Page Generation (&#39;Cross-site Scripting&#39;) **CVSS vector v.3.1**: 8.2 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N) **CVSS vector v.4.0**: 8.3 (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L) **Description**: using the `/vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.php` script, an attacker can perform a XSS-type attack **Impact**: executing arbitrary JavaScript code in the browser **Vulnerable component**: the `/vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.php` file **Exploitation conditions**: an unauthorized user **Mitigation**: sanitization of the quantity variable **Researcher**: Aleksey Solovev (Positive Technologies)</p> <p># Research</p> <p>The researcher discovered zero-day vulnerability Unauthorized Reflected Cross-Site Scripting (XSS) (in `Convert-Online.php` file) in Phpspreadsheet.</p> <p>There is no sanitization in the `/vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.php` file, which leads to the possibility of a XSS attack.</p> <p></p> <p>*Figure 4. The message with the quantity parameter is displayed without sanitization*</p> <p>The following figure shows a POST HTTP-request and a response to the server with the variable quantity, which is displayed in the response from th…</p> https://cve.radiocsirt.org/vuln/ghsa-x88g-h956-m5xg