CVE-2010-3870

The utf8_decode function in PHP before 5.3.4 does not properly handle non-shortest form UTF-8 encoding and ill-formed subsequences in UTF-8 data, which makes…

published November 12, 2010

CVSS
—
EPSS
11%
Percentile
96.0
In the wild
Unconfirmed
What it is

The utf8_decode function in PHP before 5.3.4 does not properly handle non-shortest form UTF-8 encoding and ill-formed subsequences in UTF-8 data, which makes it easier for remote attackers to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted string.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.11281 · 96.0th percentile
Published
2010-11-12T20:00Z
EPSS history
Timeline
  • 12 NOV 20:00Z
    The utf8_decode function in PHP before 5.3.4 does not properly handle non-shortest form UTF-8 encoding and ill-formed subsequences in UTF-8 data, which makes…
    cvelistv5