PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The HTML writer skips htmlspecialchars escaping when a cell's formatted value differs from the original value. When a cell has a custom number format containing the text placeholder @ along with any additional literal characters (for example ". @", "@ ", or "x@"), the formatter replaces @ with the cell value and adds the extra characters, causing the formatted value to differ from the original and bypassing HTML escaping entirely. An attacker who can control the cell value and number format of an uploaded spreadsheet that is later converted to HTML and displayed to other users can achieve stored cross-site scripting. This issue is fixed in versions 5.7.0, 3.10.5, 2.4.5, 2.1.16, and 1.30.4.
CVE-2026-35453 is a cross-site scripting (XSS) vulnerability in the PHPOffice PhpSpreadsheet library affecting multiple versions up to 5.6.0. The issue arises because the HTML Writer component fails to properly escape output when a cell uses a custom number format with the @ text placeholder combined with additional literal text. This allows an attacker who can control spreadsheet cell content to inject arbitrary HTML and JavaScript into the generated output. The vulnerability has a medium severity with a CVSS score of 4.8. Fixes have been released in PhpSpreadsheet versions 1.30.4, 2.
PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.2 and earlier, 2.0.0 through 2.1.14, 2.2.0 through 2.4.3, 3.3.0 through 3.10.3, and 4.0.0 through 5.5.0, when the filename argument to IOFactory::load() is user-controlled, an attacker can supply a PHP stream wrapper path (such as phar://, ftp://, or ssh2.sftp://) that passes the is_file() check in File::assertFile(). The phar:// wrapper triggers deserialization of the PHAR metadata, which can lead to remote code execution if a suitable gadget chain is available in the application. The ftp:// and ssh2.sftp:// wrappers can be used for server-side request forgery. This issue has been fixed in versions 1.30.3, 2.1.15, 2.4.4, 3.10.4, and 5.6.0.
The Blog Settings plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
A security flaw has been discovered in PHPGurukul Daily Expense Tracking System 1.1. Affected is an unknown function of the file /register.php. The manipulation of the argument email results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
CVE-2026-6162 is a medium severity cross-site scripting (XSS) vulnerability in PHPGurukul Company Visitor Management System version 2.0. It arises from improper handling of the 'fromdate' parameter in the /bwdates-reports-details.php file, allowing remote attackers to inject malicious scripts. The vulnerability has been publicly disclosed, but no official patch or remediation guidance is currently available.
CVE-2026-5840 is a medium severity SQL injection vulnerability in PHPGurukul News Portal Project version 4.1. The flaw exists in an unknown function within /admin/check_availability.php, where manipulation of the Username argument can lead to SQL injection. This vulnerability allows remote attackers to potentially execute unauthorized SQL commands. Although an exploit has been publicly released, there are no known exploits observed in the wild yet. No official patch or remediation guidance has been provided by the vendor at this time.
CVE-2026-5839 is a medium severity SQL injection vulnerability in PHPGurukul News Portal Project version 4.1. It arises from improper handling of the sucatdescription parameter in the /admin/add-subcategory.php file, allowing remote attackers with high privileges to manipulate SQL queries. The vulnerability has a CVSS 4.0 base score of 5.1. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.
CVE-2026-5838 is a medium severity SQL injection vulnerability in PHPGurukul News Portal Project version 4.1. It affects the /admin/add-subadmins.php file, where manipulation of the sadminusername parameter can lead to SQL injection. The vulnerability can be exploited remotely without user interaction. Although the exploit has been publicly disclosed, there are no known exploits in the wild at this time. No official patch or remediation guidance has been provided by the vendor yet.
A vulnerability was found in PHPGurukul News Portal Project 4.1. This affects an unknown part of the file /news-details.php. The manipulation of the argument Comment results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.
CVE-2026-5814 is a medium severity SQL injection vulnerability in PHPGurukul Online Course Registration version 3.1. It arises from improper handling of the 'regno' parameter in the /admin/check_availability.php file, allowing remote attackers to inject SQL commands. The vulnerability has been publicly disclosed but no official patch or remediation guidance is currently available. Exploitation could lead to partial compromise of confidentiality, integrity, and availability of the affected system's data.
CVE-2026-5813 is a medium-severity SQL injection vulnerability in PHPGurukul Online Course Registration version 3.1. The issue exists in the /check_availability.php file where manipulation of the 'cid' parameter can lead to SQL injection. This vulnerability can be exploited remotely without authentication. Although a public exploit is available, there is no confirmed patch or official remediation at this time.
CVE-2026-5641 is a medium severity SQL injection vulnerability in PHPGurukul Online Shopping Portal Project version 2.1. It affects an unknown function in the /admin/update-image1.php file, specifically through manipulation of the 'filename' parameter. The vulnerability can be exploited remotely without user interaction or elevated privileges. Although an exploit has been publicly disclosed, there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance is currently available.
CVE-2026-5640 is a medium-severity SQL injection vulnerability in PHPGurukul Online Shopping Portal Project version 2.1. The vulnerability exists in an unknown function within the /admin/update-image2.php file, where manipulation of the filename parameter allows remote attackers to perform SQL injection. The exploit has been publicly disclosed, but no official patch or remediation guidance is currently available.
CVE-2026-5639 is a medium severity SQL injection vulnerability in PHPGurukul Online Shopping Portal Project version 2.1. The flaw exists in the /admin/update-image3.php file within the Parameter Handler component, where manipulation of the 'filename' argument can lead to SQL injection. This vulnerability can be exploited remotely without user interaction or elevated privileges. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.
CVE-2026-5636 is a medium severity SQL injection vulnerability in PHPGurukul Online Shopping Portal Project version 2.1. It affects the /cancelorder.php file where the 'oid' parameter is improperly handled, allowing remote attackers to inject SQL commands. The vulnerability is publicly known, but no official patch or remediation guidance has been provided yet. Exploitation could lead to unauthorized database queries or data manipulation.
CVE-2026-5635 is a medium severity SQL injection vulnerability in PHPGurukul Online Shopping Portal Project version 2.1. The flaw exists in the /categorywise-products.php file, specifically in the handling of the 'cid' parameter. This vulnerability allows remote attackers to manipulate the SQL query via the 'cid' argument, potentially leading to unauthorized database access or modification. The exploit code has been publicly released, increasing the risk of exploitation. No official patch or remediation guidance is currently available from the vendor. The vulnerability does not affect cloud services and is limited to the specified product version.
CVE-2026-5606 is a medium severity SQL injection vulnerability in PHPGurukul Online Shopping Portal Project version 2.1. The flaw exists in the /order-details.php file where the orderid parameter is improperly handled, allowing remote attackers to inject SQL code. This vulnerability could potentially allow unauthorized access or manipulation of the backend database. No official patch or remediation guidance is currently available from the vendor. Exploits in the wild are not known at this time.
CVE-2026-5583 is a medium severity SQL injection vulnerability in PHPGurukul Online Shopping Portal Project version 2.1. The vulnerability exists in the /my-profile.php file within the Parameter Handler component, where manipulation of the 'fullname' argument can lead to SQL injection. This flaw can be exploited remotely without user interaction. The vulnerability has been publicly disclosed, but no official patch or remediation guidance is currently available.
A vulnerability was found in PHPGurukul Online Shopping Portal Project 2.1. The impacted element is an unknown function of the file /payment-method.php of the component Parameter Handler. Performing a manipulation of the argument paymethod results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.