CVE-2010-4183
HTML Purifier cross-site scripting (XSS) vulnerability
CVE-2010-4183 is a medium vulnerability (CVSS 4.3) in Htmlpurifier, published November 5, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.90%, the 59th percentile. Fixed in ezyang/htmlpurifier 4.1.0.
Multiple cross-site scripting (XSS) vulnerabilities in HTML Purifier before 4.1.0, when Internet Explorer is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) background-image, (2) background, or (3) font-family Cascading Style Sheets (CSS) property, a different vulnerability than CVE-2010-2479.
Exploit likelihood
What each source reports
NVD Score used
Multiple cross-site scripting (XSS) vulnerabilities in HTML Purifier before 4.1.0, when Internet Explorer is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) background-image, (2) background, or (3) font-family Cascading Style Sheets (CSS) property, a different vulnerability than CVE-2010-2479.
- Record
CVE-2010-4183- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Multiple cross-site scripting (XSS) vulnerabilities in HTML Purifier before 4.1.0, when Internet Explorer is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) background-image, (2) background, or (3) font-family Cascading Style Sheets (CSS) property, a different vulnerability than CVE-2010-2479.
- Record
CVE-2010-4183- Updated
- 2026-11-02
EUVDEUVD-2022-2218 No score
Multiple cross-site scripting (XSS) vulnerabilities in HTML Purifier before 4.1.0, when Internet Explorer is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) background-image, (2) background, or (3) font-family Cascading Style Sheets (CSS) property, a different vulnerability than CVE-2010-2479.
- Record
EUVD-2022-2218- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3p68-m5qw-9g9w No score
HTML Purifier cross-site scripting (XSS) vulnerability
Multiple cross-site scripting (XSS) vulnerabilities in HTML Purifier before 4.1.0, when Internet Explorer is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) background-image, (2) background, or (3) font-family Cascading Style Sheets (CSS) property, a different vulnerability than CVE-2010-2479.
- Record
GHSA-3p68-m5qw-9g9w- Weakness
- CWE-79
- Updated
- 2026-11-02
OSV No score
Multiple cross-site scripting (XSS) vulnerabilities in HTML Purifier before 4.1.0, when Internet Explorer is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) background-image, (2) background, or (3) font-family Cascading Style Sheets (CSS) property, a different vulnerability than CVE-2010-2479.
- Record
CVE-2010-4183- Updated
- 2026-11-02
OSVDEBIAN-CVE-2010-4183 No score
Multiple cross-site scripting (XSS) vulnerabilities in HTML Purifier before 4.1.0, when Internet Explorer is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) background-image, (2) background, or (3) font-family Cascading Style Sheets (CSS) property, a different vulnerability than CVE-2010-2479.
- Record
DEBIAN-CVE-2010-4183- Updated
- 2026-11-02
OSVGHSA-3p68-m5qw-9g9w No score
HTML Purifier cross-site scripting (XSS) vulnerability
Multiple cross-site scripting (XSS) vulnerabilities in HTML Purifier before 4.1.0, when Internet Explorer is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) background-image, (2) background, or (3) font-family Cascading Style Sheets (CSS) property, a different vulnerability than CVE-2010-2479.
- Record
GHSA-3p68-m5qw-9g9w- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ezyang/htmlpurifierPackagist |
before 4.1.0 | 4.1.0 |
php-htmlpurifierDebian:12 |
before 4.1.1+dfsg1-1 | 4.1.1+dfsg1-1 |
php-htmlpurifierDebian:14 |
before 4.1.1+dfsg1-1, plus listed versions 3.3.0-14.0.0+dfsg1-14.0.0-14.0.0-24.1.0+dfsg1-1 |
4.1.1+dfsg1-1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
htmlpurifier.org/news/2010/0915-4.2.0-released
nvd.nist.gov/vuln/detail/CVE-2010-4183
github.com/FriendsOfPHP/security-advisories/blob/master/ezyang/htmlpurifier/CVE-2010-4183.yaml
security-tracker.debian.org/tracker/CVE-2010-4183