CVE-2010-1860: The html_entity_decode function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent at...

Security readout for executives and security teams

CVE-2010-1860 is an old PHP runtime flaw in html_entity_decode. Under context-dependent conditions, an attacker may cause sensitive memory disclosure or memory corruption. The source bundle does not provide CVSS, confirmed affected packages beyond the PHP version ranges, or proof of active exploitation. Exposure is most likely in legacy applications still running the listed PHP 5.2 or 5.3 versions, including downstream vendor builds referenced by HP and SUSE advisories. Reachability depends on application code paths using html_entity_decode with attacker-influenced input and interruption conditions. Treat this as a legacy exposure cleanup item unless vulnerable PHP versions remain in business-critical systems. The business risk rises where old PHP applications process untrusted input and cannot be promptly patched or isolated. Mitigation focus: Inventory systems running PHP 5.2.x or 5.3.x.; Check PHP, HP, and SUSE advisory guidance for fixed packages.; Apply vendor-provided PHP updates where available..

Prepared

Jun 28, 2026, 02:49 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.