Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade postnukeUpgrade drupalUpgrade pear-XML_RPC | Dec 10, 2025 | Aug 8, 2005 |
| Gentoo Linux | — | Upgrade www-apps/egroupware.Upgrade dev-php/php.Upgrade www-apps/phpgroupware.Upgrade dev-php/phpxmlrpc.Upgrade dev-php/PEAR-XML_RPC.Upgrade www-apps/wordpress.Upgrade www-apps/phpwebsite.Upgrade www-apps/tikiwiki. | Oct 30, 2017 | Jul 5, 2005 |
| Suse | — | Upgrade php5-suhosinUpgrade php4-imapUpgrade mod_php4-coreUpgrade php4-fastcgiUpgrade apache-mod_php4Upgrade apache2-mod_php4Upgrade php4-mysqlUpgrade php4-pearUpgrade mod_php4-servletUpgrade php4-sysvshmUpgrade php4-sessionUpgrade php4-exifUpgrade php4-devel | Feb 17, 2015 | Jul 5, 2005 |
| Ubuntu | — | Upgrade libapache2-mod-php4 | Nov 8, 2024 | Jul 5, 2005 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub