CVE-2005-3539: Hylafax

High severity, CVSS 7.5. EPSS: 12.7% chance of exploitation in the next 30 days.

Multiple eval injection vulnerabilities in HylaFAX 4.2.3 and earlier allow remote attackers to execute arbitrary commands via (1) the notify script in HylaFAX 4.2.0 to 4.2.3 and (2) crafted CallID parameters to the faxrcvd script in HylaFAX 4.2.2 and 4.2.3.

Affected products

• Hylafax Hylafax: version 4.1.1 only; version 4.2 only; version 4.2.1 only; version 4.2.2 only; version 4.2.3 only

Published 2005-12-31. Last modified 2026-06-16.