CVE-2005-1921: Debian Linux

High severity, CVSS 7.5. EPSS: 79.1% chance of exploitation in the next 30 days.

Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.

Affected products

• Debian Debian Linux: version 3.1 only
• Drupal Drupal: before 4.5.4 (fixed in 4.5.4); from 4.6.0, before 4.6.2 (fixed in 4.6.2)
• Gggeek Phpxmlrpc: up to and including 1.1
• PHP XML RPC: up to and including 1.3.0
• Tiki Tikiwiki Cms/groupware: before 1.8.5 (fixed in 1.8.5)

Published 2005-07-05. Last modified 2026-06-16.