Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

shuchkin/simplexlsx

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.8PackagistPublished

    Cross-site Scripting vulnerability in SimpleXLSXEx::readThemeColors, SimpleXLSXEx::getColorValue and SimpleXLSX::toHTMLEx

    CVE-2024-56364 · GHSA-r87q-fj25-f8jf

    Affected
    • Packagist shuchkin/simplexlsx >= 1.0.12, < 1.1.13
    Fixed in
    1.1.13· Vendor fix available
    Issue
    Impact When calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code. Patches The supplied patch resolves this vulnerability for SimpleXLSX. Use 1.1.13 Workarounds Don't use data publication via toHTMLEx This vulnerability was discovered by Aleksey Solovev (Positive Technologies)

    Recommended action: Upgrade to 1.1.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. Medium, CVSS 6.8PackagistPublished

    Cross-site Scripting vulnerability in SimpleXLSXEx::readXfs and SimpeXLSX::toHTMLEx

    CVE-2024-55878 · GHSA-x6mh-rjwm-8ph7

    Affected
    • Packagist shuchkin/simplexlsx >= 1.0.12, < 1.1.12
    Fixed in
    1.1.12· Vendor fix available
    Issue
    Impact When calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code. Patches The supplied patch resolves this vulnerability for SimpleXLSX. Use 1.1.12 Workarounds Don't use direct publication via toHTMLEx This vulnerability was discovered by Aleksey Solovev (Positive Technologies)

    Recommended action: Upgrade to 1.1.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →