CVE-2024-56366: falha de alta gravidade em PHPOffice PhpSpreadsheet
PhpSpreadsheet vulnerable to unauthorized reflected XSS in the Accounting.php file
Publicada em
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.3epss 0.3%
probabilidade de exploração
0.3%top 72% das CVEs
exploração observada
nãonenhuma fonte reporta
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the `Accounting.php` file. Using the `/vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Accounting.php` script, an attacker can perform a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L
Produtos afetados
PHPOffice · PhpSpreadsheetCVEs relacionadas — PHPOffice PhpSpreadsheet
No mesmo produto, das mais perigosas para as menos.
CVE-2024-45293HIGHXML External Entity Reference (XXE) in PHPSpreadsheet's XLSX readerEPSS 2.8%CVE-2024-45291MEDIUMPath traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled in PHPSpreadsheetEPSS 0.9%CVE-2025-54370HIGHPhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browserEPSS 0.8%CVE-2024-47873HIGHPhpSpreadsheet XmlScanner bypass leads to XXEEPSS 0.8%CVE-2024-48917HIGHXXE in PHPSpreadsheet's XLSX readerEPSS 0.7%CVE-2026-34084CRITICALPhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::loadEPSS 0.7%