Vulnerability Database

300,445

Total vulnerabilities in the database

CVE-2010-3870

The utf8_decode function in PHP before 5.3.4 does not properly handle non-shortest form UTF-8 encoding and ill-formed subsequences in UTF-8 data, which makes it easier for remote attackers to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted string.

  • Published: Nov 12, 2010
  • Updated: Nov 9, 2025
  • CVE: CVE-2010-3870
  • Severity: Medium
  • Exploit:

CVSS v2:

  • Severity: Medium
  • Score: 6.8
  • AV:N/AC:M/Au:N/C:P/I:P/A:P

CWEs:

Software From Fixed in
php / php - 5.2.14
php / php 5.3.0 5.3.4
canonical / ubuntu_linux 10.10 10.10.x
canonical / ubuntu_linux 9.10 9.10.x
canonical / ubuntu_linux 8.04 8.04.x
canonical / ubuntu_linux 10.04 10.04.x
canonical / ubuntu_linux 6.06 6.06.x