Back

CVE-2005-3388

Cross-site scripting (XSS) vulnerability in the phpinfo function in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5 allows remote attackers to inject arbitrary web script or HTML via a crafted URL with a "stacked array assignment."

Published: Nov 1, 2005 Modified: Jun 16, 2026

CVSS Metrics

Affected Products (48)

Vendor Product Version
php php 4.0.0
php php 4.0.1
php php 4.0.1
php php 4.0.1
php php 4.0.2
php php 4.0.3
php php 4.0.3
php php 4.0.4
php php 4.0.5
php php 4.0.6
php php 4.0.7
php php 4.0.7
php php 4.0.7
php php 4.0.7
php php 4.1.0
php php 4.1.1
php php 4.1.2
php php 4.2
php php 4.2.0
php php 4.2.1

…and 28 more

GitHub Security Advisory GHSA-2xwg-9gx4-w8wf

Cross-site scripting (XSS) vulnerability in the phpinfo function in PHP 4.x up to 4.4.0 and 5.x...

References (64)

Risk Scores

CVSS Score 4.3 / 10
EPSS Score 48.89%

Top 1% most likely to be exploited

Threat Score 31.9 / 100

Data Sources

NVD EPSS GitHub