CVE-2026-114404

6.1 Moyenne

Publiée le 21/10/2026 à 15:18 · Modifiée le 21/10/2026 à 18:17 · Reçue · Source : disclosure@vulncheck.com

Description

PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attributes that are emitted unescaped, executing script in viewers' browsers.

Traduire en français

Produits concernés

PHPOffice PHPPresentation

Scores CVSS

Version	Score	Source	Vecteur
4.0	5.3 Moyenne	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	6.1 Moyenne	disclosure@vulncheck.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-79

Références

https://github.com/PHPOffice/PHPPresentation
https://github.com/PHPOffice/PHPPresentation/blob/1.2.0/src/PhpPresentation/Writer/HTML.php#L307-L330
https://hackmd.io/@leediay/multiple_vulnerable_phppresentation
https://www.vulncheck.com/advisories/phppresentation-1.2.0-xss-via-writer-html-text-runs-hyperlinks-and-descriptions

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories