From 6c6e46c8867d2664d051240949551ac0f4e8d635 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Thu, 6 Mar 2025 18:12:04 +0000
Subject: [PATCH] Publish Advisories

GHSA-ghg6-32f9-2jp7
GHSA-wgmf-q9vr-vww6
GHSA-v66g-p9x6-v98p
---
 .../GHSA-ghg6-32f9-2jp7.json                  | 21 ++++++++++++++++-
 .../GHSA-wgmf-q9vr-vww6.json                  | 23 +++++++++++++++++--
 .../GHSA-v66g-p9x6-v98p.json                  | 21 ++++++++++++++++-
 3 files changed, 61 insertions(+), 4 deletions(-)

diff --git a/advisories/github-reviewed/2024/08/GHSA-ghg6-32f9-2jp7/GHSA-ghg6-32f9-2jp7.json b/advisories/github-reviewed/2024/08/GHSA-ghg6-32f9-2jp7/GHSA-ghg6-32f9-2jp7.json
index e942d4fd349..4788b295e05 100644
--- a/advisories/github-reviewed/2024/08/GHSA-ghg6-32f9-2jp7/GHSA-ghg6-32f9-2jp7.json
+++ b/advisories/github-reviewed/2024/08/GHSA-ghg6-32f9-2jp7/GHSA-ghg6-32f9-2jp7.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-ghg6-32f9-2jp7",
-  "modified": "2024-09-13T13:37:31Z",
+  "modified": "2025-03-06T18:10:41Z",
   "published": "2024-08-29T17:58:27Z",
   "aliases": [
     "CVE-2024-45048"
@@ -75,6 +75,25 @@
           ]
         }
       ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "phpoffice/phpexcel"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "1.8.2"
+            }
+          ]
+        }
+      ]
     }
   ],
   "references": [
diff --git a/advisories/github-reviewed/2024/08/GHSA-wgmf-q9vr-vww6/GHSA-wgmf-q9vr-vww6.json b/advisories/github-reviewed/2024/08/GHSA-wgmf-q9vr-vww6/GHSA-wgmf-q9vr-vww6.json
index 7762c252067..84459b90dab 100644
--- a/advisories/github-reviewed/2024/08/GHSA-wgmf-q9vr-vww6/GHSA-wgmf-q9vr-vww6.json
+++ b/advisories/github-reviewed/2024/08/GHSA-wgmf-q9vr-vww6/GHSA-wgmf-q9vr-vww6.json
@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-wgmf-q9vr-vww6",
-  "modified": "2024-09-04T14:20:24Z",
+  "modified": "2025-03-06T18:09:33Z",
   "published": "2024-08-29T17:56:56Z",
   "aliases": [
     "CVE-2024-45046"
   ],
   "summary": "PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information",
-  "details": "### Summary\n\n`\\PhpOffice\\PhpSpreadsheet\\Writer\\Html` doesn't sanitize spreadsheet styling information such as font names, allowing an attacker to inject arbitrary JavaScript on the page.\n\n### PoC\n\nExample target script:\n\n```\n<?php\n\nrequire 'vendor/autoload.php';\n\n$reader = \\PhpOffice\\PhpSpreadsheet\\IOFactory::createReader(\"Xlsx\");\n$spreadsheet = $reader->load(__DIR__ . '/book.xlsx');\n\n$writer = new \\PhpOffice\\PhpSpreadsheet\\Writer\\Html($spreadsheet);\nprint($writer->generateHTMLAll());\n```\n\nSave this file in the same directory:\n[book.xlsx](https://github.com/PHPOffice/PhpSpreadsheet/files/15212797/book.xlsx)\n\nOpen index.php in a web browser. An alert should be displayed.\n\n### Impact\n\nFull takeover of the session of users viewing spreadsheet files as HTML.\n",
+  "details": "### Summary\n\n`\\PhpOffice\\PhpSpreadsheet\\Writer\\Html` doesn't sanitize spreadsheet styling information such as font names, allowing an attacker to inject arbitrary JavaScript on the page.\n\n### PoC\n\nExample target script:\n\n```\n<?php\n\nrequire 'vendor/autoload.php';\n\n$reader = \\PhpOffice\\PhpSpreadsheet\\IOFactory::createReader(\"Xlsx\");\n$spreadsheet = $reader->load(__DIR__ . '/book.xlsx');\n\n$writer = new \\PhpOffice\\PhpSpreadsheet\\Writer\\Html($spreadsheet);\nprint($writer->generateHTMLAll());\n```\n\nSave this file in the same directory:\n[book.xlsx](https://github.com/PHPOffice/PhpSpreadsheet/files/15212797/book.xlsx)\n\nOpen index.php in a web browser. An alert should be displayed.\n\n### Impact\n\nFull takeover of the session of users viewing spreadsheet files as HTML.",
   "severity": [
     {
       "type": "CVSS_V3",
@@ -56,6 +56,25 @@
           ]
         }
       ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "phpoffice/phpexcel"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "1.8.2"
+            }
+          ]
+        }
+      ]
     }
   ],
   "references": [
diff --git a/advisories/github-reviewed/2024/10/GHSA-v66g-p9x6-v98p/GHSA-v66g-p9x6-v98p.json b/advisories/github-reviewed/2024/10/GHSA-v66g-p9x6-v98p/GHSA-v66g-p9x6-v98p.json
index dc616478e39..2c4ebddb695 100644
--- a/advisories/github-reviewed/2024/10/GHSA-v66g-p9x6-v98p/GHSA-v66g-p9x6-v98p.json
+++ b/advisories/github-reviewed/2024/10/GHSA-v66g-p9x6-v98p/GHSA-v66g-p9x6-v98p.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-v66g-p9x6-v98p",
-  "modified": "2024-10-07T22:24:52Z",
+  "modified": "2025-03-06T18:11:24Z",
   "published": "2024-10-07T14:43:30Z",
   "aliases": [
     "CVE-2024-45060"
@@ -75,6 +75,25 @@
           ]
         }
       ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "phpoffice/phpexcel"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "1.8.2"
+            }
+          ]
+        }
+      ]
     }
   ],
   "references": [