CVE-2026-114404— PHPPresentation 1.2.0 XSS via Writer\HTML Text Runs, Hyperlinks and Descriptions
Quick assessment
Affected
PHPOffice PHPPresentation
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PHPOffice PHPPresentation 1.2.0 的 HTML 写入器中存在跨站脚本（XSS）漏洞。该漏洞允许攻击者在提供演示文稿内容时，向生成的 HTML 中注入脚本。攻击者可构造包含恶意文本运行（text runs）、超链接关系目标（hyperlink relationship targets）或形状描述属性（shape descr attributes）的 PPTX 文件，这些内容在输出时未经转义，从而在查看者的浏览器中执行恶意脚本。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-114404
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PHPPresentation 1.2.0 XSS via Writer\HTML Text Runs, Hyperlinks and Descriptions
Source: CVE Program / CVE List V5
Vulnerability Description
PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attributes that are emitted unescaped, executing script in viewers' browsers.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| PHPOffice | PHPPresentation | 1.2.0 ~ 1.2.0 | - |
|
II. Public POCs for CVE-2026-114404
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-114404
请登录查看更多情报信息。
Other References for CVE-2026-114404 (4)
-
https://hackmd.io/@leediay/multiple_vulnerable_phppresentation third-party-advisory
IV. Related Vulnerabilities
Same vendor: PHPOffice
-
CVE-2026-114403
PHPOffice PHPPresentation through 1.2.0 Deserialization via -
CVE-2026-59932
PhpSpreadsheet: Gnumeric reader unbounded gzip expansion cau -
CVE-2026-59933
PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory -
CVE-2026-59931
PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE( -
CVE-2026-45034
PhpSpreadsheet: File::prohibitWrappers bypass
Same weakness: CWE-79
-
CVE-2026-113787
odf-kit: HTML injection leading to XSS in odtToHtml() via un -
CVE-2026-111848
WordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scriptin -
CVE-2026-111837
WordPress Contest Gallery plugin <= 34.0.1 - Cross Site Scri -
CVE-2026-112221
WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (X -
CVE-2026-111840
WordPress Paid Videochat Turnkey Site plugin <= 7.5.14 - Cro
V. Comments for CVE-2026-114404
No comments yet