Injection and Smuggling

Every one of the 10 is a mark on the map. Named now: 1 to 10, most at risk first.

1. TablePress < 2.4.3 - XXE InjectionCVE-2024-45293PHPOffice · CVSS 7.5 · 2.8% likely

   CWE-611

2. securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx fileCVE-2018-19277Phpoffice · 7.8% likely

   CWE-91

3. XMLReader.php in PHPOffice Common before 0.2.9 allows XXE.CVE-2018-14065Phpoffice Project · 2.2% likely

   CWE-611

4. PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared in the header. This w…CVE-2019-12331Phpoffice · 1.4% likely

   CWE-611

5. PhpSpreadsheet XmlScanner bypass leads to XXECVE-2024-47873PHPOffice · CVSS 7.5 · 0.8% likely

   CWE-611

6. XXE in PHPSpreadsheet's XLSX readerCVE-2024-48917PHPOffice · CVSS 7.5 · 0.7% likely

   CWE-611

7. PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of ServiceCVE-2026-108358PHPOffice · CVSS 8.8 · 0.6% likely

   CWE-611

8. XML External Entity Reference (XXE) in PHPSpreadsheetCVE-2024-45048PHPOffice · CVSS 8.8 · 0.6% likely

   CWE-611

9. PHPOffice Math allows XXE when processing an XML file in the MathML formatCVE-2025-48882PHPOffice · CVSS 8.7 · 0.5% likely

   CWE-611

10. PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of ServiceCVE-2026-108357PHPOffice · CVSS 8.8 · 0.5% likely

    CWE-611

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.