Skip to content
Back to search

CVE-2005-1921

HIGH
7.5NVD

Summary

generated automatically from NVD data

PEAR XML_RPC (up to 1.3.0) and PHPXMLRPC (up to 1.1) contain an eval injection flaw (CWE-94): data from an XML file is not properly sanitized before being passed to a PHP eval statement. A remote attacker can use this to execute arbitrary PHP code. Applications that embed these libraries, including WordPress, Drupal, TikiWiki and Serendipity, are affected as well. The CVSS v2.0 score is 7.5 (HIGH).

NVD description

Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.

Share:

EPSS · FIRST.org

79.1%probability of exploitation in the next 30 days

Higher than 99% of scored CVEs

EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-29, recomputed daily by FIRST.org.

CVSS v2.0 Score

7.5
/ 10.0
HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P

Information

Published
5 juil. 2005
Updated
16 juin 2026
Status
Modified
Source
secalert@redhat.com

Affected products

php xml rpc
Versions ≤ 1.3.0
gggeek phpxmlrpc
Versions ≤ 1.1
drupal drupal
Versions < 4.5.4 · ≥ 4.6.0, < 4.6.2
tiki tikiwiki cms\/groupware
Versions < 1.8.5
debian debian linux
Versions 3.1

Bounds published by NVD: "< 8.4.27" means 8.4.27 is no longer vulnerable. The fixed release to install is in the vendor advisory.

Weaknesses (CWE)

CWE-94

References (100)

Similar CVEs

Other vulnerabilities of type CWE-94

…

Know which CVEs hit the versions you run.

Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.

Add my first deviceI already have an account