CVE-2005-1921
HighPublic exploitEval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7)…
Published Jun 29, 2005 · Updated Mar 9, 2026 · Also known as DEBIAN-CVE-2005-1921, DEBIAN-CVE-2005-2106, DSA-745-1, DSA-746-1, DSA-747-1
Key Facts
Patch immediately- CVE-2005-1921 is a high-severity vulnerability (CVSS 7.5 v2) affecting Drupal, Phpxmlrpc (Gggeek), XML Rpc (PHP) and 6 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 79% probability of exploitation in the next 30 days.
- Fixed versions are available, including Drupal 4.5.3-3, Drupal 4.5.4, egroupware 1.0.0.007-2.dfsg-2sarge1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v2
7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS (30-day exploit likelihood)
79%
Higher than 99.5% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2005-1921 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.
Affected Products
10 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| DrupalDrupal | See advisory | 4.5.4 |
| PhpxmlrpcGggeek | See advisory | 1.1 |
| XML RpcPHP | See advisory | 1.3.0 |
| Tikiwiki Cms\/groupwareTiki | See advisory | 1.8.5 |
| Debian LinuxDebian | 3.1 | n/a |
Patched Releases
Drupal
4.5.3-3, 4.5.4
egroupware
1.0.0.007-2.dfsg-2sarge1
Phpxmlrpc
1.1
php
0:4.3.9-3.7
XML Rpc
1.3.0
php4
4:4.1.2-7.woody5, 4:4.3.10-16, 4:4.3.10-16etch1
phpgroupware
0.9.16.005-3.sarge0
Tikiwiki Cms\/groupware
1.8.5
Timeline
Publicly disclosed
Jun 29, 2005
Last updated
Mar 9, 2026
Weakness Type
- CWE-94 Improper Control of Generation of Code ('Code Injection')
References
- advisory20050629 Advisory 02/2005: Remote code execution in Serendipity
- advisory20050629 [DRUPAL-SA-2005-003] Drupal 4.6.2 / 4.5.4 fixes critical XML-RPC issue
- advisorySUSE-SA:2005:051
- advisoryRHSA-2005:564
- advisoryGLSA-200507-01
FAQ
Common Questions.
Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows…
Affected: Drupal; Phpxmlrpc (Gggeek); XML Rpc (PHP), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Drupal 4.5.3-3, Drupal 4.5.4, egroupware 1.0.0.007-2.dfsg-2sarge1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2005-1921 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo