High
CVE-2026-59933
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 35
Reset filters
High
CVE-2026-59932
PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
High
CVE-2026-59931
PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
Critical
CVE-2026-45034
PHPSpreadsheet has a patch bypass for CVE-2026-34084
High
CVE-2026-40902
PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions
High
CVE-2026-40863
PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader
Critical
CVE-2026-34084
PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled
Medium
CVE-2026-40296
PhpSpreadsheet has XSS via number format code with @ text placeholder bypasses htmlspecialchars in HTML writer
Medium
CVE-2026-35453
PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer
Low
ghsa-44jg-mv3h-wj6g
solspace/craft-freeform Vulnerable to XSS in `PhpSpreadsheet` HTML Writer Due to Unsanitized Styling Data
High
CVE-2025-54370
PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser
Medium
CVE-2025-23210
PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters
Medium
CVE-2025-22131
Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet
Medium
CVE-2024-56412
PhpSpreadsheet allows bypass XSS sanitizer using the javascript protocol and special characters
Medium
CVE-2024-56411
PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header
Medium
CVE-2024-56410
PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability in custom properties
High
CVE-2024-56409
PhpSpreadsheet allows unauthorized Reflected XSS in Currency.php file
High
CVE-2024-56366
PhpSpreadsheet allows unauthorized Reflected XSS in the Accounting.php file
High
CVE-2024-56365
PhpSpreadsheet allows unauthorized Reflected XSS in the constructor of the Downloader class
High
CVE-2024-56408
PhpSpreadsheet allows unauthorized Reflected XSS in `Convert-Online.php` file
High
CVE-2024-48917
XXE in PHPSpreadsheet's XLSX reader
High
CVE-2024-47873
XmlScanner bypass leads to XXE
Medium
CVE-2024-45292
PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks
Medium
CVE-2024-45291
PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.