Summary
generated automatically from NVD dataSnoopy 1.2, a PHP HTTP client library reused by products such as MagpieRSS, WordPress, Ampache, and Jinzora, has an input validation flaw (CWE-20) in its _httpsrequest function. Shell metacharacters placed in an HTTPS URL pointing to an SSL protected page are not properly handled by the fetch function, so remote attackers can execute arbitrary commands. The issue is rated HIGH with a CVSS v2.0 score of 7.5.
NVD description
The _httpsrequest function in Snoopy 1.2, as used in products such as (1) MagpieRSS, (2) WordPress, (3) Ampache, and (4) Jinzora, allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTPS URL to an SSL protected web page, which is not properly handled by the fetch function.
EPSS · FIRST.org
17.2%probability of exploitation in the next 30 days
Higher than 97% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-20, recomputed daily by FIRST.org.
CVSS v2.0 Score
Information
- Published
- 27 oct. 2005
- Updated
- 16 juin 2026
- Status
- Modified
- Source
- cve@mitre.org
Affected products
Weaknesses (CWE)
References (34)
- http://secunia.com/advisories/17455Vendor Advisory
- http://secunia.com/advisories/17779Vendor Advisory
- http://secunia.com/advisories/17887Vendor Advisory
- http://www.vupen.com/english/advisories/2005/2202Vendor Advisory
- http://www.vupen.com/english/advisories/2005/2335Vendor Advisory
- http://www.vupen.com/english/advisories/2005/2727Vendor Advisory
- + 19 more references on NVD
Similar CVEs
Other vulnerabilities of type CWE-20
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.