CVE-2004-0595: The strip_tags function in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, does not filter null (\0) character...

Security readout for executives and security teams

This is an old PHP input-filtering flaw. Some PHP versions could leave dangerous HTML tags intact when null characters were inserted, letting certain browsers treat the content as executable script. The business risk is mainly legacy web applications that still rely on vulnerable PHP filtering for user-supplied HTML. Exposure is most likely in legacy PHP applications using strip_tags to sanitize untrusted HTML while allowing some tags. Current, supported PHP deployments are less likely to be affected, but old embedded systems, abandoned sites, or vendor appliances should be checked. Prioritize this for legacy PHP estate review, not emergency response. No active exploitation is cited, but the flaw affects web-facing input handling and can support browser-based account compromise where old PHP remains deployed. Mitigation focus: Inventory PHP versions and identify PHP 4.x through 4.3.7 or PHP 5.x through 5.0.0RC3.; Apply the relevant vendor security updates for the operating system or PHP distribution.; Retire or isolate legacy PHP applications that cannot be updated promptly..

Prepared

Jun 30, 2026, 04:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.