> CVE-2025-23210

« BACK_TO_HOME
PUBLISHED
2025-02-03 22:15
MODIFIED
2025-02-03 22:15
EPSS (Prob. Exploit)
0.42%
Top 63.9%
DATA SOURCES:
NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 OSV 🔗 2026-11-08

> DESCRIPTION

phpoffice/phpspreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions have been found to have a Bypass of the Cross-site Scripting (XSS) sanitizer using the javascript protocol and special characters. This issue has been addressed in versions 3.9.0, 2.3.7, 2.1.8, and 1.29.9. Users are advised to upgrade. There are no known workarounds for this vulnerability.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Bypass XSS sanitizer using the javascript protocol and special characters in phpoffice/phpspreadsheet

AFFECTED PACKAGES:
Unknown / Unknown
72 versions affected
ALIASES:
GHSA-r57h-547h-w24f

> HISTORIQUE DES MODIFICATIONS

Première apparition
03/02/2025 22:15
Source: NVD
📊 ENRICHISSEMENT 18/10/2025 15:00
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 1 Dernière mise à jour: 1 year ago
« BACK_TO_HOME