Unscored severity · published Dec 6, 2005
CVE-2005-4031
Eval injection vulnerability in MediaWiki 1.5.x before 1.5.3 allows remote attackers to execute arbitrary PHP code via the "user language option," which is used as part of a…
–
CVSS
3.2%
EPSS
No
On KEV
Description
Eval injection vulnerability in MediaWiki 1.5.x before 1.5.3 allows remote attackers to execute arbitrary PHP code via the "user language option," which is used as part of a dynamic class name that is processed using the eval function.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.2% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ME
Mediawiki · Mediawiki
1.5.0; 1.5.1; 1.5.2; 1.5_alpha1; 1.5_alpha2; 1.5_beta1; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-4031
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-4031
Patch
http://secunia.com/advisories/17866
Patch
http://sourceforge.net/project/shownotes.php?group_id=34373&release_id=375755
US Government Resource
http://www.kb.cert.org/vuls/id/392156
Patch
http://www.securityfocus.com/bid/15703
www.vupen.com
http://www.vupen.com/english/advisories/2005/2726
More from Mediawiki
9.8
CVE-2026-58025
Remote Code Execution via Unsafe Deserialization in LogItem Import
9.8
CVE-2025-67484
Action API xslt option allows JavaScript execution by administrators who are not interface administrators
9.8
CVE-2024-34502
An issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1
9.8
CVE-2023-37303
An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3
9.8
CVE-2023-29141
An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3