{"id":"CVE-2005-1921","url":"https://www.cyber-defence.io/tools/cve/CVE-2005-1921","generatedAt":"2026-10-27T18:32:01.360Z","title":"Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5)…","description":"Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.","published":"2005-07-05T04:00:00.000Z","lastModified":"2026-06-16T22:13:55.000Z","status":"Modified","sourceIdentifier":"secalert@redhat.com","cvss":{"version":"2.0","score":7.5,"severity":"HIGH","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P"},"cwe":["CWE-94"],"affected":["php/xml rpc","gggeek/phpxmlrpc","drupal/drupal","tiki/tikiwiki cms\\/groupware","debian/debian linux"],"epss":{"score":0.79071,"percentile":0.99595,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":5,"verified":true,"firstPublished":"2005-07-01","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":43829,"kind":"exploit","title":"PHPXMLRPC < 1.1 - Remote Code Execution","url":"https://www.exploit-db.com/exploits/43829","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/43829.txt","file":"exploits/php/webapps/43829.txt","published":"2015-07-02","added":"2018-01-19","updated":"2018-01-19","author":"GulfTech Security","type":"webapps","platform":"php","port":null,"verified":false,"codes":["GTSA-00081","CVE-2005-1921"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"http://gulftech.org/advisories/PHPXMLRPC%20Remote%20Code%20Execution/81"},{"edbId":16882,"kind":"exploit","title":"XML-RPC Library 1.3.0 - 'xmlrpc.php' Arbitrary Code Execution (Metasploit)","url":"https://www.exploit-db.com/exploits/16882","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/16882.rb","file":"exploits/php/webapps/16882.rb","published":"2010-07-25","added":"2010-07-25","updated":"2016-10-27","author":"Metasploit","type":"webapps","platform":"php","port":null,"verified":true,"codes":["CVE-2005-1921","OSVDB-17793"],"tags":"Metasploit Framework (MSF)","aliases":null,"applicationUrl":"http://www.exploit-db.comxmlrpc-1.0.99.tar.gz","screenshotUrl":null,"referenceUrl":null},{"edbId":1084,"kind":"exploit","title":"XML-RPC Library 1.3.0 - 'xmlrpc.php' Remote Command Execution (3)","url":"https://www.exploit-db.com/exploits/1084","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/1084.pl","file":"exploits/php/webapps/1084.pl","published":"2005-07-04","added":"2005-07-03","updated":"2016-10-27","author":"Mike Rifone","type":"webapps","platform":"php","port":null,"verified":true,"codes":["CVE-2005-1921"],"tags":null,"aliases":null,"applicationUrl":"http://www.exploit-db.comxmlrpc-1.0.99.tar.gz","screenshotUrl":null,"referenceUrl":null},{"edbId":1083,"kind":"exploit","title":"XML-RPC Library 1.3.0 - 'xmlrpc.php' Remote Command Execution (2)","url":"https://www.exploit-db.com/exploits/1083","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/1083.pl","file":"exploits/php/webapps/1083.pl","published":"2005-07-04","added":"2005-07-03","updated":"2016-10-27","author":"dukenn","type":"webapps","platform":"php","port":null,"verified":true,"codes":["CVE-2005-1921"],"tags":null,"aliases":null,"applicationUrl":"http://www.exploit-db.comxmlrpc-1.0.99.tar.gz","screenshotUrl":null,"referenceUrl":null},{"edbId":1078,"kind":"exploit","title":"XML-RPC Library 1.3.0 - 'xmlrpc.php' Remote Code Injection","url":"https://www.exploit-db.com/exploits/1078","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/1078.pl","file":"exploits/php/webapps/1078.pl","published":"2005-07-01","added":"2005-06-30","updated":"2016-10-27","author":"ilo--","type":"webapps","platform":"php","port":null,"verified":true,"codes":["OSVDB-17793","CVE-2005-2116","CVE-2005-1921"],"tags":null,"aliases":null,"applicationUrl":"http://www.exploit-db.comxmlrpc-1.0.99.tar.gz","screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 79.1%, higher than 100% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://marc.info/?l=bugtraq&m=112008638320145&w=2","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=112015336720867&w=2","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=112605112027335&w=2","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://pear.php.net/package/XML_RPC/download/1.3.1","tags":["Patch","Product"],"source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/15810","tags":["Broken Link"],"source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/15852","tags":["Broken Link"],"source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/15855","tags":["Broken Link"],"source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/15861","tags":["Broken Link"],"source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/15872","tags":["Broken Link"],"source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/15883","tags":["Broken Link"],"source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/15884","tags":["Broken Link"],"source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/15895","tags":["Broken Link"],"source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/15903","tags":["Broken Link"],"source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/15904","tags":["Broken Link"],"source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/15916","tags":["Broken Link"],"source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/15917","tags":["Broken Link"],"source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/15922","tags":["Broken Link"],"source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/15944","tags":["Broken Link"],"source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/15947","tags":["Broken Link"],"source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/15957","tags":["Broken Link"],"source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/16001","tags":["Broken Link"],"source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/16339","tags":["Broken Link"],"source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/16693","tags":["Broken Link"],"source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/17440","tags":["Broken Link"],"source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/17674","tags":["Broken Link"],"source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/18003","tags":["Broken Link"],"source":"secalert@redhat.com"},{"url":"http://security.gentoo.org/glsa/glsa-200507-01.xml","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://security.gentoo.org/glsa/glsa-200507-06.xml","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://security.gentoo.org/glsa/glsa-200507-07.xml","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://securitytracker.com/id?1015336","tags":["Broken Link","Third Party Advisory","VDB Entry"],"source":"secalert@redhat.com"},{"url":"http://sourceforge.net/project/showfiles.php?group_id=87163","tags":["Product"],"source":"secalert@redhat.com"},{"url":"http://sourceforge.net/project/shownotes.php?release_id=338803","tags":["Broken Link"],"source":"secalert@redhat.com"},{"url":"http://www.ampache.org/announce/3_3_1_2.php","tags":["Broken Link"],"source":"secalert@redhat.com"},{"url":"http://www.debian.org/security/2005/dsa-745","tags":["Mailing List","Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://www.debian.org/security/2005/dsa-746","tags":["Mailing List","Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://www.debian.org/security/2005/dsa-747","tags":["Mailing List","Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://www.debian.org/security/2005/dsa-789","tags":["Mailing List","Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://www.drupal.org/security/drupal-sa-2005-003/advisory.txt","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://www.gulftech.org/?node=research&article_id=00087-07012005","tags":["Not Applicable","Vendor Advisory"],"source":"secalert@redhat.com"},{"url":"http://www.hardened-php.net/advisory-022005.php","tags":["Not Applicable"],"source":"secalert@redhat.com"},{"url":"http://www.mandriva.com/security/advisories?name=MDKSA-2005:109","tags":["Patch","Third Party Advisory","Vendor Advisory"],"source":"secalert@redhat.com"},{"url":"http://www.novell.com/linux/security/advisories/2005_18_sr.html","tags":["Broken Link"],"source":"secalert@redhat.com"},{"url":"http://www.novell.com/linux/security/advisories/2005_41_php_pear.html","tags":["Broken Link"],"source":"secalert@redhat.com"},{"url":"http://www.novell.com/linux/security/advisories/2005_49_php.html","tags":["Broken Link"],"source":"secalert@redhat.com"},{"url":"http://www.redhat.com/support/errata/RHSA-2005-564.html","tags":["Broken Link"],"source":"secalert@redhat.com"},{"url":"http://www.securityfocus.com/archive/1/419064/100/0/threaded","tags":["Broken Link","Third Party Advisory","VDB Entry"],"source":"secalert@redhat.com"},{"url":"http://www.securityfocus.com/bid/14088","tags":["Broken Link","Third Party Advisory","VDB Entry"],"source":"secalert@redhat.com"},{"url":"http://www.vupen.com/english/advisories/2005/2827","tags":["Broken Link"],"source":"secalert@redhat.com"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11294","tags":["Broken Link"],"source":"secalert@redhat.com"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A350","tags":["Broken Link"],"source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=112008638320145&w=2","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://marc.info/?l=bugtraq&m=112015336720867&w=2","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://marc.info/?l=bugtraq&m=112605112027335&w=2","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://pear.php.net/package/XML_RPC/download/1.3.1","tags":["Patch","Product"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/15810","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/15852","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/15855","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/15861","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/15872","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/15883","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2005-1921","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}