CVE-2005-1921: Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka X...

Security readout for executives and security teams

This flaw affects old PHP XML-RPC libraries that were embedded in several web applications. A remote attacker could submit crafted XML that the library passes into PHP eval, enabling arbitrary PHP code execution. That can mean full application compromise if an exposed legacy installation still uses the vulnerable library. Exposure is most likely in legacy PHP applications or distributions that bundled PEAR XML_RPC or PHPXMLRPC from 2005-era codebases. Modern systems are not automatically affected unless they retain those vulnerable libraries or embedded copies. Treat this as urgent for any legacy internet-facing PHP estate. The business risk is application takeover, but the immediate action is targeted inventory and vendor-guided remediation, not broad emergency action against modern systems without evidence of affected libraries. Mitigation focus: Inventory PHP applications for PEAR XML_RPC and PHPXMLRPC usage.; Check vendor advisories for fixed package versions and upgrade guidance.; Remove or disable unused XML-RPC functionality where operationally safe..

Prepared

Jun 29, 2026, 19:30 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.