HTML Purifier cross-site scripting (XSS) vulnerability

MEDIO 4.3CVE-2010-4183 · GHSA-3p68-m5qw-9g9w · Published 05/11/2010 · updated 16/06/2026

En resumen

CVE-2010-4183 es una vulnerabilidad MEDIO (CVSS 4.3) que afecta a ezyang/htmlpurifier, htmlpurifier (htmlpurifier).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.90%, mayor que el 59.8% de las vulnerabilidades.
Solución: actualizar a 4.1.0 o posterior.

Package	Affected versions	Patched versions
ezyang/htmlpurifier Packagist	`< 4.1.0`	`4.1.0`
htmlpurifier htmlpurifier	`= 1.0.0= 1.0.1= 1.1.0= 1.1.1= 1.1.2= 1.2.0= 1.3.0= 1.3.1= 1.3.2= 1.4.0= 1.4.1= 1.5.0= 1.6.0= 1.6.1= 2.0.0= 2.0.1= 2.1.0= 2.1.1= 2.1.2= 2.1.3= 2.1.4= 2.1.5= 3.0.0= 3.1.0= 3.1.1= 3.2.0= 3.3.0= 4.0.0≤ 4.0.0`	No fix yet

Description

Multiple cross-site scripting (XSS) vulnerabilities in HTML Purifier before 4.1.0, when Internet Explorer is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) background-image, (2) background, or (3) font-family Cascading Style Sheets (CSS) property, a different vulnerability than CVE-2010-2479.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2010-4183 · ADVISORY
FriendsOfPHP/security-advisories · WEB
ezyang/htmlpurifier · PACKAGE
htmlpurifier.org/news/2010/0915-4.2.0-released · WEB
htmlpurifier.org/security/2010/css-quoting · WEB

Más vulnerabilidades de ezyang/htmlpurifier

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

ezyang/htmlpurifier

Packagist

< 4.1.0

4.1.0

htmlpurifier

= 1.0.0= 1.0.1= 1.1.0= 1.1.1= 1.1.2= 1.2.0= 1.3.0= 1.3.1= 1.3.2= 1.4.0= 1.4.1= 1.5.0= 1.6.0= 1.6.1= 2.0.0= 2.0.1= 2.1.0= 2.1.1= 2.1.2= 2.1.3= 2.1.4= 2.1.5= 3.0.0= 3.1.0= 3.1.1= 3.2.0= 3.3.0= 4.0.0≤ 4.0.0

No fix yet

Description

NVD description

Más vulnerabilidades de ezyang/htmlpurifier

Ver todo →