CVE-2004-0595

The strip_tags function in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, does not filter null (\0) characters within tag names when restricting input to allowed tags, which allows dangerous tags to be processed by web browsers such as Internet Explorer and Safari, which ignore null characters and facilitate the exploitation of cross-site scripting (XSS) vulnerabilities.

CVSS v2.0

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

45.16% chance of exploitation in the next 30 days, 99th percentile

Published

2004-07-16

Updated

2024-08-08

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/24280

References

• CVE Record
• NVD entry

Related

• CVE-2004-0594
• CVE-2004-0597
• CVE-2004-0591
• CVE-2004-0600
• CVE-2004-0580
• CVE-2004-0605