phpoffice/phppresentation vulnerabilities

Latest phpoffice/phppresentation CVEs

Newest publication first

1. CVE-2026-114404 PHPPresentation 1.2.0 XSS via Writer\HTML Text Runs, Hyperlinks and Descriptions

   Published 2026-10-21

   Medium·CVSS 5.3 EPSS 0.26%

   PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or sha...

2. CVE-2026-114403 PHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\Serialized::load

   Published 2026-10-21

   Critical·CVSS 9.2 EPSS 0.70%

   PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.