Skip to content
Fencer Vulns
high 7.5

CVE-2005-1921 in the critical feed json

Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.…

published 2005-07-01 21 y ago modified 2026-06-16 4 mo ago also EUVD-2005-1923

cvss
7.5
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
79.1%
EPSS 79.1% chance of exploitation in 30 days, percentile 99.6%
public exploits
6
Metasploit, Exploit-DB

Summary

Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.

Patch / fix

  • drupal drupal 4.5.4, 4.6.2
  • tiki tikiwiki_cms/groupware 1.8.5
  • php RHEL 3 4.3.2-24.ent
  • php RHEL 4 4.3.9-3.7
  • php-gd RHEL 4 4.3.9-3.7
  • php-imap RHEL 3 4.3.2-24.ent
  • php-imap RHEL 4 4.3.9-3.7
  • php-ldap RHEL 3 4.3.2-24.ent
  • php-ldap RHEL 4 4.3.9-3.7
  • php-odbc RHEL 3 4.3.2-24.ent

red hat advisories RHSA-2005:564

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2005-1921 updated

security flaw

  • Red Hat Desktop version 3 php 4.3.2-24.ent, php-imap 4.3.2-24.ent, php-ldap 4.3.2-24.ent, php-odbc 4.3.2-24.ent, php-mysql 4.3.2-24.ent, php-pgsql 4.3.2-24.ent Red Hat Enterprise Linux AS version 3 php 4.3.2-24.ent, php-imap 4.3.2-24.ent, php-ldap 4.3.2-24.ent, php-odbc 4.3.2-24.ent, php-mysql 4.3.2-24.ent, php-pgsql 4.3.2-24.ent Red Hat Enterprise Linux AS version 4 php 4.3.9-3.7, php-gd 4.3.9-3.7, php-imap 4.3.9-3.7, php-ldap 4.3.9-3.7, php-odbc 4.3.9-3.7, php-pear 4.3.9-3.7, +7 more Red Hat Enterprise Linux Desktop version 4 php 4.3.9-3.7, php-gd 4.3.9-3.7, php-imap 4.3.9-3.7, php-ldap 4.3.9-3.7, php-odbc 4.3.9-3.7, php-pear 4.3.9-3.7, +7 more Red Hat Enterprise Linux ES version 3 php 4.3.2-24.ent, php-imap 4.3.2-24.ent, php-ldap 4.3.2-24.ent, php-odbc 4.3.2-24.ent, php-mysql 4.3.2-24.ent, php-pgsql 4.3.2-24.ent Red Hat Enterprise Linux ES version 4 php 4.3.9-3.7, php-gd 4.3.9-3.7, php-imap 4.3.9-3.7, php-ldap 4.3.9-3.7, php-odbc 4.3.9-3.7, php-pear 4.3.9-3.7, +7 more
    +2 more products
    Red Hat Enterprise Linux WS version 3 php 4.3.2-24.ent, php-imap 4.3.2-24.ent, php-ldap 4.3.2-24.ent, php-odbc 4.3.2-24.ent, php-mysql 4.3.2-24.ent, php-pgsql 4.3.2-24.ent Red Hat Enterprise Linux WS version 4 php 4.3.9-3.7, php-gd 4.3.9-3.7, php-imap 4.3.9-3.7, php-ldap 4.3.9-3.7, php-odbc 4.3.9-3.7, php-pear 4.3.9-3.7, +7 more
    fixed: vendor fix RHSA-2005:564

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (Metasploit exploit/unix/webapp/php_xmlrpc_eval)
  2. Published

Exploit prediction

79.07% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Metasploit exploit/unix/webapp/php_xmlrpc_eval PHP XML-RPC Arbitrary Code Execution metasploit exploit, excellent rank, 2005-06-29
  • EDB-43829 PHPXMLRPC < 1.1 - Remote Code Execution webapps, 2015-07-02
  • EDB-16882 XML-RPC Library 1.3.0 - 'xmlrpc.php' Arbitrary Code Execution (Metasploit) webapps, 2010-07-25
  • EDB-1084 XML-RPC Library 1.3.0 - 'xmlrpc.php' Remote Command Execution (3) webapps, 2005-07-04
  • EDB-1083 XML-RPC Library 1.3.0 - 'xmlrpc.php' Remote Command Execution (2) webapps, 2005-07-04
  • EDB-1078 XML-RPC Library 1.3.0 - 'xmlrpc.php' Remote Code Injection webapps, 2005-07-01

CVSS scores

assigned by version score vector
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.