Exploit for Cross-site Scripting in Phpoffice Phpspreadsheet

CVE-2025-22131

githubexploit · 2025-09-05

Description

XSS exploit PoC targeting Phpoffice PhpSpreadsheet, CVE-2025-22131.

Affected Phpoffice Phpspreadsheet versions

Phpoffice Phpspreadsheet< 1.29.8, 2.1.7, 2.3.6, 3.8.0

All known vulnerabilities by product

Phpspreadsheet

CVSS 6.1 for CVE-2025-22131

6.1

MEDIUM SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector:NETWORK

Attack Complexity:LOW

Attack Requirements:NONE

Privileges Required:NONE

User Interaction:ACTIVE

Working code

96%confidence this exploit runs

Based on 2 file(s) in the source

EPSS Score

0.4%higher than 30.2% of all CVEs

Updated 2026-07-31

Exploit Details

Modified:2025-09-05 06:09

Last Seen:2025-09-06 15:38

Reporter:s0ck37

Written in:Python

Last commit:2025-09-05

Other exploits for CVE-2025-22131

Exploit for Cross-site Scripting in Phpoffice Phpspreadsheet

2025-09-03 ZzN1NJ4GITHUB

Exploit for CVE-2024-47875

2025-09-02 roj1pyGITHUB

Exploit Code

README7 lines

## https://sploitus.com/exploit?id=CF7CCE2A-A9B7-50AB-A67D-C6E8F302FA3B
# CVE-2025-22131 POC
## CVE-2025-22131 XSS Exploit by s0ck37

![title](out.png)

Reference: https://sploitus.com/exploit?id=152DAC32-8330-54D6-A916-7FC36EAA38B7

Exploit Code

Share

Share on social media: