Curated security research, vulnerabilities, advisories and tools for practitioners.

← back | CVE Intelligence

CVE-2018-19277

Curated 1 security research writeups, vulnerability advisories and exploitation analyses for CVE-2018-19277.

Coverage Span: 2018-11-30
Reports: 1 related reports

Associated Reports & Timeline

PhpSpreadsheet Versions<=1.5.0 - XXE injection

PhpSpreadsheet up to 1.5.0 is vulnerable to XXE (CVE-2018-19277): attackers bypass its entity check with a UTF-7 encoded XLSX payload to read files, secrets and source code.