Threats tagged 'ghsa-6wpp-88cp-7q68'

1 threat

Severity	CVSS	Threat	Source	Published	Score and star
Medium	4.8	CVE-2026-35453phpoffice/phpspreadsheet · PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer Medium4.82026-04-28GCVE DatabaseCVE-2026-35453 PhpSpreadsheet's HTML Writer component has a cross-site scripting (XSS) vulnerability due to improper escaping when using custom number formats containing the '@' text placeholder with additional literal text. This flaw allows malicious XLSX files to inject arbitrary HTML and JavaScript into generated HTML output. The vulnerability affects multiple versions prior to fixed releases and can lead to XSS if the HTML output is served by a web server. Report on CVE-2026-35453 Vulnerability CWE-79 #ghsa-6wpp-88cp-7q68 #packagist	GCVE Database	2026-04-28

Page 1 of 1