PhpSpreadsheet

Every one of the 34 is a mark on the map. Named now: 1 to 26, most at risk first.

1. TablePress < 2.4.3 - XXE InjectionCVE-2024-45293PHPOffice · CVSS 7.5 · 2.8% likely

   CWE-611

2. securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx fileCVE-2018-19277Phpoffice · 7.8% likely

   CWE-91

3. PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared in the header. This w…CVE-2019-12331Phpoffice · 1.4% likely

   CWE-611

4. Path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled in PHPSpreadsheetCVE-2024-45291PHPOffice · CVSS 6.3 · 0.9% likely

   CWE-36

5. PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browserCVE-2025-54370PHPOffice · CVSS 8.7 · 0.8% likely

   CWE-918

6. PhpSpreadsheet XmlScanner bypass leads to XXECVE-2024-47873PHPOffice · CVSS 7.5 · 0.8% likely

   CWE-611

7. XXE in PHPSpreadsheet's XLSX readerCVE-2024-48917PHPOffice · CVSS 7.5 · 0.7% likely

   CWE-611

8. PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::loadCVE-2026-34084PHPOffice · CVSS 9.2 · 0.7% likely

   CWE-502

9. PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)CVE-2026-108359PHPOffice · CVSS 8.7 · 0.7% likely

   CWE-789

10. PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of ServiceCVE-2026-108358PHPOffice · CVSS 8.8 · 0.6% likely

    CWE-611

11. Path traversal and Server-Side Request Forgery when opening XLSX files in PHPSpreadsheetCVE-2024-45290PHPOffice · CVSS 7.7 · 0.6% likely

    CWE-36

12. XML External Entity Reference (XXE) in PHPSpreadsheetCVE-2024-45048PHPOffice · CVSS 8.8 · 0.6% likely

    CWE-611

13. Unauthenticated Cross-Site-Scripting (XSS) in sample file in PHPSpreadsheetCVE-2024-45060PHPOffice · CVSS 7.1 · 0.5% likely

    CWE-79

14. PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelistCVE-2026-59931PHPOffice · CVSS 7.7 · 0.5% likely

    CWE-918

15. PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of ServiceCVE-2026-108357PHPOffice · CVSS 8.8 · 0.5% likely

    CWE-611

16. PhpSpreadsheet: File::prohibitWrappers bypassCVE-2026-45034PHPOffice · CVSS 9.2 · 0.5% likelycovered by CyberSIXT

    CWE-502

17. PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustionCVE-2026-59933PHPOffice · CVSS 7.5 · 0.5% likely

    CWE-400

18. PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustionCVE-2026-59932PHPOffice · CVSS 7.5 · 0.5% likely

    CWE-409

19. Bypass XSS sanitizer using the javascript protocol and special characters in phpoffice/phpspreadsheetCVE-2025-23210PHPOffice · CVSS 4.8 · 0.4% likely

    CWE-79

20. PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style informationCVE-2024-45046PHPOffice · CVSS 5.4 · 0.4% likely

    CWE-79

21. PhpSpreadsheet allows unauthorized reflected XSS in `Convert-Online.php` fileCVE-2024-56408PHPOffice · CVSS 8.3 · 0.4% likely

    CWE-79

22. Cross-Site Scripting (XSS) vulnerability in generateNavigation() functionCVE-2025-22131PHPOffice · CVSS 5.1 · 0.4% likely

    CWE-79

23. PhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row DimensionsCVE-2026-40902PHPOffice · CVSS 7.5 · 0.4% likely

    CWE-770

24. PhpSpreadsheet: CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML ReaderCVE-2026-40863PHPOffice · CVSS 7.5 · 0.4% likely

    CWE-770

25. PhpSpreadsheet vulnerable to bypass of the XSS sanitizer using the javascript protocol and special charactersCVE-2024-56412PHPOffice · CVSS 4.8 · 0.4% likely

    CWE-79

26. PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page headerCVE-2024-56411PHPOffice · CVSS 4.8 · 0.4% likely

    CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.