XSS in Phpoffice Phpspreadsheet
CVE-2024-56412
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to bypass of the cross-site scripting sanitizer using the javascript protocol and special character…
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.003 (54.5th percentile) — read the EPSS interpretation.
Affected products
- Phpoffice Phpspreadsheet — versions >= 3.0.0, < 3.7.0, < 1.29.7, >= 2.0.0, < 2.1.6