Unscored severity · published Jul 5, 2005
CVE-2005-1921
Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such…
–
CVSS
79.1%
EPSS
No
On KEV
Description
Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.
Exploitation
Is it being used?
Exploit prediction (EPSS)79.1% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DR
Drupal · Drupal
before 4.5.4; 4.6.0 before 4.6.2 · source: NVD
DL
Debian Linux · Debian
3.1 · source: NVD
PH
Phpxmlrpc · Gggeek
through 1.1 · source: NVD
TC
Tikiwiki Cms/groupware · Tiki
before 1.8.5 · source: NVD
XR
Xml Rpc · Php
through 1.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-1921
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-1921
Third Party Advisory
http://marc.info/?l=bugtraq&m=112008638320145&w=2
Third Party Advisory
http://marc.info/?l=bugtraq&m=112015336720867&w=2
Third Party Advisory
http://marc.info/?l=bugtraq&m=112605112027335&w=2
Patch
http://pear.php.net/package/XML_RPC/download/1.3.1
Broken Link
http://secunia.com/advisories/15810
Broken Link
http://secunia.com/advisories/15852
More from Drupal
9.8
CVE-2026-9082
Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
9.8
CVE-2018-7602
Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004
9.8
CVE-2018-7600
Drupal Core Remote Code Execution Vulnerability
8.8
CVE-2020-13671
Drupal core Un-restricted Upload of File
8.1
CVE-2019-6340
Drupal core - Highly critical - Remote Code Execution