MEDIUMPackagist
GHSA-28rm-rj57-qjpv· CVE-2014-2054PHPExcel vulnerable to XXE attacks through libxml
Modified: 3/31/2025
package
Packagist/phpoffice/phpexcel
pkg:packagist/phpoffice/phpexcel
HIGHPackagist
GHSA-3m9x-2qfj-xvq4· CVE-2015-3542PHPExcel XXE Vulnerability
Modified: 11/7/2024
MEDIUM6.4Packagist
GHSA-4mqv-gcr3-pff9· CVE-2020-7776, SNYK-PHP-PHPOFFICEPHPSPREADSHEET-1048856Cross-site scripting in phpoffice/phpspreadsheet
Modified: 7/8/2026
HIGH7.7Packagist
GHSA-5gpr-w2p5-6m37· CVE-2024-45290PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery when opening XLSX file
Modified: 2/4/2026
HIGH7.5Packagist
GHSA-6hwr-6v2f-3m88· CVE-2024-45293XXE in PHPSpreadsheet's XLSX reader
Modified: 3/6/2025
MEDIUM6.1Packagist
GHSA-79xx-vf93-p7cx· CVE-2025-22131Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet
Modified: 3/6/2025
HIGH7.5Packagist
GHSA-7cc9-j4mv-vcjp· CVE-2024-48917XXE in PHPSpreadsheet's XLSX reader
Modified: 3/6/2025
HIGH7.1Packagist
GHSA-c6fv-7vh8-2rhr· CVE-2024-56366PhpSpreadsheet allows unauthorized Reflected XSS in the Accounting.php file
Modified: 3/6/2025
HIGH8.8Packagist
GHSA-ghg6-32f9-2jp7· CVE-2024-45048XXE in PHPSpreadsheet encoding is returned
Modified: 3/6/2025
MEDIUM5.4Packagist
GHSA-hwcp-2h35-p66w· CVE-2024-56411PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header
Modified: 3/6/2025
HIGH7.1Packagist
GHSA-j2xg-cjcx-4677· CVE-2024-56409PhpSpreadsheet allows unauthorized Reflected XSS in Currency.php file
Modified: 9/10/2026
HIGH7.1Packagist
GHSA-jmpx-686v-c3wx· CVE-2024-56365PhpSpreadsheet allows unauthorized Reflected XSS in the constructor of the Downloader class
Modified: 3/6/2025
HIGH7.5Packagist
GHSA-jw4x-v69f-hh5w· CVE-2024-47873XmlScanner bypass leads to XXE
Modified: 3/6/2025
MEDIUM5.4Packagist
GHSA-q9jv-mm3r-j47r· CVE-2024-56412PhpSpreadsheet allows bypass XSS sanitizer using the javascript protocol and special characters
Modified: 3/6/2025
MEDIUM5.4Packagist
GHSA-r57h-547h-w24f· CVE-2025-23210PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters
Modified: 3/6/2025
MEDIUM5.4Packagist
GHSA-r8w8-74ww-j4wh· CVE-2024-45292PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks
Modified: 3/6/2025
MEDIUM6.1Packagist
GHSA-v66g-p9x6-v98p· CVE-2024-45060PhpSpreadsheet has an Unauthenticated Cross-Site-Scripting (XSS) in sample file
Modified: 3/6/2025
HIGH8.8Packagist
GHSA-vvwv-h69m-wg6f· CVE-2019-12331XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue
Modified: 3/6/2025
MEDIUM6.3Packagist
GHSA-w9xv-qf98-ccq4· CVE-2024-45291PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled
Modified: 2/4/2026
MEDIUM5.4Packagist
GHSA-wgmf-q9vr-vww6· CVE-2024-45046PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information
Modified: 3/6/2025
MEDIUM5.4Packagist
GHSA-wv23-996v-q229· CVE-2024-56410PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability in custom properties
Modified: 3/6/2025
HIGH7.1Packagist
GHSA-x88g-h956-m5xg· CVE-2024-56408PhpSpreadsheet allows unauthorized Reflected XSS in `Convert-Online.php` file
Modified: 9/10/2026
HIGH8.8Packagist
GHSA-xcrg-29h7-h4cj· CVE-2018-19277XXE in PHPSpreadsheet due to encoding issue
Modified: 3/6/2025