phpoffice/phpexcel vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-23210Mediumphpoffice/phpspreadsheet: PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters CVE-2025-22131Mediumphpoffice/phpspreadsheet: Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet CVE-2024-56412Mediumphpoffice/phpspreadsheet: PhpSpreadsheet allows bypass XSS sanitizer using the javascript protocol and special characters CVE-2024-56411Mediumphpoffice/phpspreadsheet: PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header CVE-2024-56410Mediumphpoffice/phpspreadsheet: PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability in custom properties CVE-2024-56409Highphpoffice/phpspreadsheet: PhpSpreadsheet allows unauthorized Reflected XSS in Currency.php file CVE-2024-56366Highphpoffice/phpspreadsheet: PhpSpreadsheet allows unauthorized Reflected XSS in the Accounting.php file CVE-2024-56365Highphpoffice/phpspreadsheet: PhpSpreadsheet allows unauthorized Reflected XSS in the constructor of the Downloader class CVE-2024-56408Highphpoffice/phpspreadsheet: PhpSpreadsheet allows unauthorized Reflected XSS in `Convert-Online.php` file CVE-2024-48917Highphpoffice/phpspreadsheet: XXE in PHPSpreadsheet's XLSX reader CVE-2024-47873Highphpoffice/phpspreadsheet: XmlScanner bypass leads to XXE CVE-2015-3542Highphpoffice/phpexcel: PHPExcel XXE Vulnerability CVE-2024-45293Highphpoffice/phpspreadsheet: XXE in PHPSpreadsheet's XLSX reader CVE-2024-45292Mediumphpoffice/phpspreadsheet: PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks CVE-2024-45291Mediumphpoffice/phpspreadsheet: PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled CVE-2024-45290Highphpoffice/phpspreadsheet: PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery when opening XLSX file CVE-2024-45060Mediumphpoffice/phpspreadsheet: PhpSpreadsheet has an Unauthenticated Cross-Site-Scripting (XSS) in sample file CVE-2024-45048Highphpoffice/phpspreadsheet: XXE in PHPSpreadsheet encoding is returned CVE-2024-45046Mediumphpoffice/phpspreadsheet: PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information CVE-2014-2054Mediumphpoffice/phpexcel: PHPExcel vulnerable to XXE attacks through libxml CVE-2020-7776Mediumphpoffice/phpspreadsheet: Cross-site scripting in phpoffice/phpspreadsheet CVE-2019-12331Highphpoffice/phpspreadsheet: XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue CVE-2018-19277Highphpoffice/phpspreadsheet: XXE in PHPSpreadsheet due to encoding issue

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo