Eval injection vulnerability in PHPXMLRPC 1.1.1 and earlier (PEAR XML-RPC for PHP), as used in multiple products including (1) Drupal, (2) phpAdsNew, (3) phpPgAds, and (4) phpgroupware, allows remote attackers to execute arbitrary PHP code via certain nested XML tags in a PHP document that should not be nested, which are injected into an eval function call, a different vulnerability than CVE-2005-1921.
CVSS Details
- CVSS 3.1 Base Score: 7.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade egroupwareUpgrade drupalUpgrade phpgroupwareUpgrade pear-XML_RPCUpgrade phpmyfaqUpgrade phpAdsNewUpgrade b2evolution | Dec 10, 2025 | Aug 15, 2005 |
| Gentoo Linux | — | Upgrade www-apps/tikiwiki.Upgrade dev-php/PEAR-XML_RPC.Upgrade www-apps/phpwebsite.Upgrade dev-php/php-cgi.Upgrade www-apps/phpwiki.Upgrade dev-php/phpxmlrpc.Upgrade dev-php/mod_php.Upgrade www-apps/egroupware.Upgrade www-apps/phpgroupware.Upgrade dev-php/php. | Oct 30, 2017 | Aug 15, 2005 |
| Suse | — | Upgrade mod_php4-servletUpgrade apache2-mod_php4Upgrade php4-sysvshmUpgrade php4-pearUpgrade php4-develUpgrade php4-imapUpgrade mod_php4-coreUpgrade php4-mysqlUpgrade php4-exifUpgrade php4-sessionUpgrade apache-mod_php4Upgrade php5-suhosinUpgrade php4-fastcgi | Feb 17, 2015 | Aug 15, 2005 |
| Ubuntu | — | Upgrade php4-pear | Nov 8, 2024 | Aug 15, 2005 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub