CVE-2009-4142

The htmlspecialchars function in PHP before 5.2.12 does not properly handle (1) overlong UTF-8 sequences, (2) invalid Shift_JIS sequences, and (3) invalid…

published December 21, 2009

CVSS
—
EPSS
6%
Percentile
93.7
In the wild
Unconfirmed
What it is

The htmlspecialchars function in PHP before 5.2.12 does not properly handle (1) overlong UTF-8 sequences, (2) invalid Shift_JIS sequences, and (3) invalid EUC-JP sequences, which allows remote attackers to conduct cross-site scripting (XSS) attacks by placing a crafted byte sequence before a special character.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.06497 · 93.7th percentile
Published
2009-12-21T16:00Z
EPSS history
Timeline
  • 21 DEC 16:00Z
    The htmlspecialchars function in PHP before 5.2.12 does not properly handle (1) overlong UTF-8 sequences, (2) invalid Shift_JIS sequences, and (3) invalid…
    cvelistv5