Phppresentation
Monthly
PHPOffice PHPPresentation through version 1.2.0 will pass attacker-controlled serialized data to unserialize() when IOFactory::load() is pointed at a crafted presentation file, letting remote unauthenticated attackers instantiate arbitrary PHP objects inside the hosting application. Where a usable gadget chain exists in the application or its dependencies, that object instantiation escalates to code execution or arbitrary file writes; without gadgets the realistic outcome is object injection or denial of service, which is why the assessed vector marks a present attack requirement (AT:P) rather than an unconditional network exploit. No confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis, but the library is widely embedded in document-conversion and upload pipelines, so exposure depends entirely on whether the vulnerable Serialized reader path is reachable from untrusted input.
Cross-site scripting in PHPOffice PHPPresentation 1.2.0's HTML writer lets attacker-influenced PPTX content execute script when the generated HTML is viewed in a browser. The writer emits text runs, hyperlink relationship targets, and shape descr attributes without HTML or attribute escaping, so applications that convert untrusted presentations to HTML and serve that output are exposed. This is a medium-severity library issue with no public exploit identified at time of analysis; exploitation requires the application to use the affected writer and a victim to view the crafted HTML, making real-world risk bounded and context-dependent.
PHPOffice PHPPresentation through version 1.2.0 will pass attacker-controlled serialized data to unserialize() when IOFactory::load() is pointed at a crafted presentation file, letting remote unauthenticated attackers instantiate arbitrary PHP objects inside the hosting application. Where a usable gadget chain exists in the application or its dependencies, that object instantiation escalates to code execution or arbitrary file writes; without gadgets the realistic outcome is object injection or denial of service, which is why the assessed vector marks a present attack requirement (AT:P) rather than an unconditional network exploit. No confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis, but the library is widely embedded in document-conversion and upload pipelines, so exposure depends entirely on whether the vulnerable Serialized reader path is reachable from untrusted input.
Cross-site scripting in PHPOffice PHPPresentation 1.2.0's HTML writer lets attacker-influenced PPTX content execute script when the generated HTML is viewed in a browser. The writer emits text runs, hyperlink relationship targets, and shape descr attributes without HTML or attribute escaping, so applications that convert untrusted presentations to HTML and serve that output are exposed. This is a medium-severity library issue with no public exploit identified at time of analysis; exploitation requires the application to use the affected writer and a victim to view the crafted HTML, making real-world risk bounded and context-dependent.