EDB-46050

PoC

PhpSpreadsheet < 1.5.0 - XML External Entity (XXE)

view exploit source exploit_dbtype webappsauthor Alex Leahupublished 2018-11-30catalog exploit_db

exploited CVEs (1)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2018-19277US	high8.8	7.79% (95th)	Exploit	2018-11-14
securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.