CVE-2004-0595 describes a cross-site scripting (XSS) vulnerability in the strip_tags function of PHP versions 4.x up to 4.3.7 and 5.x up to 5.0.0RC3, affecting products like Avaya, PHP, Red Hat, and Trustix. The vulnerability arises because the function fails to filter null characters within tag names, which web browsers like Internet Explorer and Safari ignore, allowing malicious tags to be processed. With a CVSS score of 6.8 (medium severity), this vulnerability is remotely exploitable with medium attack complexity, potentially leading to partial confidentiality, integrity, and availability impacts. While not actively exploited in the wild (no KEV entry), exploit code is publicly available via ExploitDB, though there is minimal community discussion or media coverage surrounding this older CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.0CPE matchmatch criteria | cpe:2.3:h:avaya:converged_communications_server:2.0:*:*:*:*:*:*:* | ||
core_1.0CPE matchmatch criteria | cpe:2.3:o:redhat:fedora_core:core_1.0:*:*:*:*:*:*:* | ||
core_2.0CPE matchmatch criteria | cpe:2.3:o:redhat:fedora_core:core_2.0:*:*:*:*:*:*:* | ||
1.5CPE matchmatch criteria | cpe:2.3:o:trustix:secure_linux:1.5:*:*:*:*:*:*:* | ||
2.0CPE matchmatch criteria | cpe:2.3:o:trustix:secure_linux:2.0:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:M/Au:N/C:P/I:P/A:P
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.