Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cross-site Scripting (XSS)
Vulnerability Description
This affects the package phpoffice/phpspreadsheet from 0.0.0. The library is vulnerable to XSS when creating an html output from an excel file by adding a comment on any cell. The root cause of this issue is within the HTML writer where user comments are concatenated as part of link and this is returned as HTML. A fix for this issue is available on commit 0ed5b800be2136bcb8fa9c1bdf59abc957a98845/master branch.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Vulnerability Type
N/A
Vulnerability Title
PHPOffice PhpSpreadsheet 跨站脚本漏洞
Vulnerability Description
PHPOffice PhpSpreadsheet是一款用于读取和写入电子表格文件的PHP库。 phpoffice/phpspreadsheet 0.0.0版本存在安全漏洞，该漏洞源于从0.0.0影响包phpoffice phpspreadsheet。当通过在任何单元格上添加注释从excel文件创建html输出时，库容易受到XSS的攻击。这个问题的根本原因是在HTML编写器中，用户评论作为链接的一部分连接在一起，并以HTML的形式返回。
CVSS Information
N/A
Vulnerability Type
N/A