VulnerabilityModified

CVE-2005-1921

EXPLOIT ×5 ✓HIGH 7.5EPSS 79.1%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 79.1%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.

Description

Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.

CVSS 2.0: 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS: 79.07% probability · 100th percentile
Public exploits: 5 in Exploit-DB · verified · first 1 July 2005
CISA KEV: Not listed
Weakness: CWE-94
Affected: php/xml rpc · gggeek/phpxmlrpc · drupal/drupal · tiki/tikiwiki cms\/groupware · debian/debian linux
Source: secalert@redhat.com

EPSS trend

EPSS 79.1% since 26 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

Public exploits (5)

Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.

EDB-ID	Title	Type	Published	Verified
EDB-43829 source ↗	PHPXMLRPC < 1.1 - Remote Code Executionphp · GulfTech Security	webapps	2 July 2015	no
EDB-16882 source ↗	XML-RPC Library 1.3.0 - 'xmlrpc.php' Arbitrary Code Execution (Metasploit)php · Metasploit	webapps	25 July 2010	yes
EDB-1084 source ↗	XML-RPC Library 1.3.0 - 'xmlrpc.php' Remote Command Execution (3)php · Mike Rifone	webapps	4 July 2005	yes
EDB-1083 source ↗	XML-RPC Library 1.3.0 - 'xmlrpc.php' Remote Command Execution (2)php · dukenn	webapps	4 July 2005	yes
EDB-1078 source ↗	XML-RPC Library 1.3.0 - 'xmlrpc.php' Remote Code Injectionphp · ilo--	webapps	1 July 2005	yes

References

http://marc.info/?l=bugtraq&m=112008638320145&w=2Third Party Advisory
http://marc.info/?l=bugtraq&m=112015336720867&w=2Third Party Advisory
http://marc.info/?l=bugtraq&m=112605112027335&w=2Third Party Advisory
http://pear.php.net/package/XML_RPC/download/1.3.1Patch, Product
http://secunia.com/advisories/15810Broken Link
http://secunia.com/advisories/15852Broken Link
http://secunia.com/advisories/15855Broken Link
http://secunia.com/advisories/15861Broken Link
http://secunia.com/advisories/15872Broken Link
http://secunia.com/advisories/15883Broken Link
http://secunia.com/advisories/15884Broken Link
http://secunia.com/advisories/15895Broken Link
http://secunia.com/advisories/15903Broken Link
http://secunia.com/advisories/15904Broken Link
http://secunia.com/advisories/15916Broken Link
http://secunia.com/advisories/15917Broken Link
http://secunia.com/advisories/15922Broken Link
http://secunia.com/advisories/15944Broken Link
http://secunia.com/advisories/15947Broken Link
http://secunia.com/advisories/15957Broken Link
http://secunia.com/advisories/16001Broken Link
http://secunia.com/advisories/16339Broken Link
http://secunia.com/advisories/16693Broken Link
http://secunia.com/advisories/17440Broken Link
http://secunia.com/advisories/17674Broken Link
http://secunia.com/advisories/18003Broken Link
http://security.gentoo.org/glsa/glsa-200507-01.xmlThird Party Advisory
http://security.gentoo.org/glsa/glsa-200507-06.xmlThird Party Advisory
http://security.gentoo.org/glsa/glsa-200507-07.xmlThird Party Advisory
http://securitytracker.com/id?1015336Broken Link, Third Party Advisory, VDB Entry

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.