MEDIUM 5.3 NVD
CVE-2026-114404
PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject
PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attributes that are emitted unescaped, executing script in viewers' browsers.
References
- https://github.com/PHPOffice/PHPPresentation
- https://github.com/PHPOffice/PHPPresentation/blob/1.2.0/src/PhpPresentation/Writer/HTML.ph
- https://hackmd.io/@leediay/multiple_vulnerable_phppresentation
- https://www.vulncheck.com/advisories/phppresentation-1.2.0-xss-via-writer-html-text-runs-h
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-10-21 via NVD.
vulnfeed aggregates 18720 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.