net.sf.mpxj:mpxj
MPXJ is a library which allows you to read, manipulate, and write project information from Java, .Net, Python and Ruby. MPXJ supports a range of data formats: Microsoft Project Exchange (MPX), Microsoft Project (MPP, MPT), Microsoft Project Data Interchange (MSPDI XML), Microsoft Project Database (MPD), Planner (XML), Primavera P6 (PMXML, XER, and database), Primavera P3, Primavera Suretrak, Asta Powerproject (PP, MDB), Asta Easyplan (PP), Phoenix Project Manager (PPX), FastTrack Schedule (FTS), Ganttproject (GAN), Turboproject (PEP), Conceptdraw PROJECT (CDPX, CDPZ, CDPTZ), Synchro Scheduler (SP) Gantt Designer (GNT), Standard Data Exchange Format (SDEF), Project Commander (PC), Deltek Open Plan (BK3), and Edraw Project (EDPX). MPXJ can also read project data from Microsoft Project Server, Primavera P6 Web Services (P6 EPPM), and Oracle Primavera Cloud (OPC).
96%
Total Score
100
74
100
100
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-417987 New mpxj is vulnerable to Insecure Temporary File in versions 7.3.0 - 16.5.0. | 7.3.0 - 16.5.0 | Low |
CVE-2024-49771 net.sf.mpxj:mpxj is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 8.3.5 - 13.5.1. | 8.3.5 - 13.5.1 | Medium |
CVE-2022-41954 net.sf.mpxj:mpxj is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 0.0.0 - 10.14.1. | 0.0.0 - 10.14.1 | Low |
CVE-2020-25020 net.sf.mpxj:mpxj is vulnerable to Improper Restriction of XML External Entity Reference in versions 0.0.0 - 8.1.4. | 0.0.0 - 8.1.4 | Critical |
CVE-2020-35460 net.sf.mpxj:mpxj is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 8.3.5. | 0.0.0 - 8.3.5 | Medium |
Package versions
Maintainers
No maintainer information available.
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 org.apache.poi:poi Version 5.5.1 | — | — |
org.xerial:sqlite-jdbc Version 3.51.2.0 | — | — |
com.jgoodies:jgoodies-binding Version 2.13.0 | — | — |
com.github.joniles:rtfparserkit Version 1.16.0 | — | — |
jakarta.xml.bind:jakarta.xml.bind-api Version 3.0.1 | — | — |
Weekly Downloads
Info
- Last Published
- 4 days ago
- Created
- 10 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant