XSS in Phpoffice Phpspreadsheet
CVE-2024-56410
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have a cross-site scripting (XSS) vulnerability in custom properties. The HTML page is generated without clearing…
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.009 (76.1th percentile) — read the EPSS interpretation.
Affected products
- Phpoffice Phpspreadsheet — versions >= 3.0.0, < 3.7.0, < 1.29.7, >= 2.0.0, < 2.1.6