$ cve CVE-2004-0595 JSON

CVE-2004-0595 EXPLOIT

6.8

MEDIUM · CVSS 2.0 · EPSS 45.2% (pctl 99)

Patch early

A public exploit exists.

Description

The strip_tags function in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, does not filter null (\0) characters within tag names when restricting input to allowed tags, which allows dangerous tags to be processed by web browsers such as Internet Explorer and Safari, which ignore null characters and facilitate the exploitation of cross-site scripting (XSS) vulnerabilities.

Scoring

CVSS	6.8 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS	45.16% — more likely to be exploited than 99% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2004-07-27
Last modified	2026-06-16

Affected (8)

Vendor	Product
avaya	converged communications server
avaya	integrated management
avaya	s8300
avaya	s8500
avaya	s8700
php	php
redhat	fedora core
trustix	secure linux

Public exploits

Source	Title	Date
exploit-db	PHP 4.x/5.0 - 'Strip_Tags()' Function Bypass	2004-07-14

References

→ the Explorer · watch your stack · NVD