A regression error in the phpinfo function in PHP 4.4.3 to 4.4.6 and PHP 6.0 in CVS allows remote attackers to conduct cross-site scripting (XSS) attacks via GET POST or COOKIE array values which are not escaped in the phpinfo output as originally fixed for CVE-2005-3388.