CVE-2004-0595

medium · 6.8

The strip_tags function in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, does not filter null (\0) characters within tag names when restricting input to allowed tags, which allows dangerous tags to be processed by web browsers such as Internet Explorer and Safari, which ignore null characters and facilitate the exploitation of cross-site scripting (XSS) vulnerabilities.

6.8

CVSS

45.2%

EPSS (exploit prob.)

99th

EPSS percentile

2004-07-27

Published

AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

Vendor	Product	Affected versions
avaya	converged_communications_server	2.0
redhat	fedora_core	core_1.0
redhat	fedora_core	core_2.0
trustix	secure_linux	1.5
trustix	secure_linux	2.0
trustix	secure_linux	2.1
avaya	integrated_management	all versions
php	php	4.0
php	php	4.0.1
php	php	4.0.2
php	php	4.0.3
php	php	4.0.4
php	php	4.0.5
php	php	4.0.6
php	php	4.0.7
php	php	4.1.0
php	php	4.1.1
php	php	4.1.2
php	php	4.2.0
php	php	4.2.1
php	php	4.2.2
php	php	4.2.3
php	php	4.3.0
php	php	4.3.1
php	php	4.3.2
php	php	4.3.3
php	php	4.3.5
php	php	4.3.6
php	php	4.3.7
php	php	5.0
php	php	5.0
php	php	5.0
avaya	s8300	r2.0.0
avaya	s8300	r2.0.1
avaya	s8500	r2.0.0
avaya	s8500	r2.0.1
avaya	s8700	r2.0.0
avaya	s8700	r2.0.1

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2004-0595