$ cve CVE-2005-1921 JSON

CVE-2005-1921 EXPLOIT

7.5

HIGH · CVSS 2.0 · EPSS 79.1% (pctl 100)

Patch early

A public exploit exists.

Description

Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.

Scoring

CVSS	7.5 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS	79.07% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-94
On CISA KEV	no
Public exploit	yes
Published	2005-07-05
Last modified	2026-06-16

Affected (5)

Vendor	Product
debian	debian linux
drupal	drupal
gggeek	phpxmlrpc
php	xml rpc
tiki	tikiwiki cms\/groupware

Public exploits

Source	Title	Date
exploit-db	PHPXMLRPC < 1.1 - Remote Code Execution	2015-07-02
exploit-db	XML-RPC Library 1.3.0 - 'xmlrpc.php' Arbitrary Code Execution (Metasploit)	2010-07-25
exploit-db	XML-RPC Library 1.3.0 - 'xmlrpc.php' Remote Command Execution (2)	2005-07-04
exploit-db	XML-RPC Library 1.3.0 - 'xmlrpc.php' Remote Command Execution (3)	2005-07-04
exploit-db	XML-RPC Library 1.3.0 - 'xmlrpc.php' Remote Code Injection	2005-07-01

References

→ the Explorer · watch your stack · NVD