HIGH
security flaw
Published Aug 15, 2005
7.5
HIGHCVSS 2.0
EPSS 5.09%
Description
Eval injection vulnerability in PHPXMLRPC 1.1.1 and earlier (PEAR XML-RPC for PHP), as used in multiple products including (1) Drupal, (2) phpAdsNew, (3) phpPgAds, and (4) phpgroupware, allows remote attackers to execute arbitrary PHP code via certain nested XML tags in a PHP document that should not be nested, which are injected into an eval function call, a different vulnerability than CVE-2005-1921.
Affected products
No data.
Configuration 2
- 3.1
No data.
Red Hat Enterprise Linux 3
php-0:4.3.2-25.ent
Fixed · RHSA-2005:748
Red Hat Enterprise Linux 4
php-0:4.3.9-3.8
Fixed · RHSA-2005:748
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 3 | php-0:4.3.2-25.ent | Fixed | RHSA-2005:748 |
| Red Hat Enterprise Linux 4 | php-0:4.3.9-3.8 | Fixed | RHSA-2005:748 |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
No CVSS v3.1 score for this CVE.
No CVSS v3.0 score for this CVE.
7.5 HIGH NVD
AV:N/AC:L/Au:N/C:P/I:P/A:P
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact Partial
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
5.09% 0.05091
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
EPSS probability 0.05091
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (13 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 5.09% (0.05091) | 92.09th | v5 (v2026.06.15) |
| Jun 15, 2026 | 5.09% (0.05091) | 91.23th | v5 (v2026.06.15) |
| Mar 30, 2025 | 4.69% (0.04688) | 88.33th | v4 (v2025.03.14) |
| Mar 29, 2025 | 8.74% (0.08737) | 87.28th | v4 (v2025.03.14) |
| Mar 19, 2025 | 4.69% (0.04688) | 88.04th | v4 (v2025.03.14) |
| Mar 17, 2025 | 3.41% (0.03412) | 86.61th | v4 (v2025.03.14) |
| Dec 17, 2024 | 3.59% (0.03589) | 91.50th | v3 (v2023.03.01) |
| Dec 12, 2024 | 1.03% (0.01032) | 84.54th | v3 (v2023.03.01) |
| Feb 15, 2024 | 1.22% (0.01216) | 84.88th | v3 (v2023.03.01) |
| Mar 7, 2023 | 1.06% (0.01058) | 81.80th | v3 (v2023.03.01) |
| Mar 6, 2023 | 4.36% (0.04358) | 88.02th | v2 (v2022.01.01) |
| Apr 1, 2022 | 4.36% (0.04358) | 86.83th | v2 (v2022.01.01) |
| Feb 4, 2022 | 4.36% (0.04358) | 70.59th | v2 (v2022.01.01) |
Weaknesses (1)
References (37)
- http://marc.info/?l=bugtraq&m=112412415822890&w=2 mailing-listx_refsource_BUGTRAQThird Party Advisory
- http://marc.info/?l=bugtraq&m=112431497300344&w=2 mailing-listx_refsource_BUGTRAQThird Party Advisory
- http://marc.info/?l=bugtraq&m=112605112027335&w=2 vendor-advisoryx_refsource_SUSEThird Party Advisory
- http://secunia.com/advisories/16431 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/16432 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/16441 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/16460 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/16465 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/16468 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/16469 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/16491 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/16550 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/16558 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/16563 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/16619 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/16635 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/16693 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/16976 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/17053 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/17066 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/17440 third-party-advisoryx_refsource_SECUNIABroken Link
- http://www.debian.org/security/2005/dsa-789 vendor-advisoryx_refsource_DEBIANMailing ListThird Party Advisory
- http://www.debian.org/security/2005/dsa-798 vendor-advisoryx_refsource_DEBIANMailing ListThird Party Advisory
- http://www.debian.org/security/2005/dsa-840 vendor-advisoryx_refsource_DEBIANMailing List
- http://www.debian.org/security/2005/dsa-842 vendor-advisoryx_refsource_DEBIANMailing ListThird Party Advisory
- http://www.fedoralegacy.org/updates/FC2/2005-11-28-FLSA_2005_166943__Updated_php_packages_fix_security_issues.html vendor-advisoryx_refsource_FEDORABroken Link
- http://www.gentoo.org/security/en/glsa/glsa-200509-19.xml vendor-advisoryx_refsource_GENTOOThird Party Advisory
- http://www.hardened-php.net/advisory_152005.67.html x_refsource_MISCNot ApplicablePatchVendor Advisory
- http://www.novell.com/linux/security/advisories/2005_49_php.html vendor-advisoryx_refsource_SUSEBroken Link
- http://www.redhat.com/support/errata/RHSA-2005-748.html vendor-advisoryx_refsource_REDHATBroken Link
- http://www.securityfocus.com/archive/1/408125 mailing-listx_refsource_BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/14560 vdb-entryx_refsource_BIDBroken LinkThird Party AdvisoryVDB Entry
- https://access.redhat.com/security/cve/CVE-2005-2498 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1617729 Issue Tracking
- https://nvd.nist.gov/vuln/detail/CVE-2005-2498
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9569 vdb-entrysignaturex_refsource_OVALBroken Link
- https://www.cve.org/CVERecord?id=CVE-2005-2498
| Link | Providers | Tags |
|---|---|---|
| http://marc.info/?l=bugtraq&m=112412415822890&w=2 | mailing-listx_refsource_BUGTRAQThird Party Advisory | |
| http://marc.info/?l=bugtraq&m=112431497300344&w=2 | mailing-listx_refsource_BUGTRAQThird Party Advisory | |
| http://marc.info/?l=bugtraq&m=112605112027335&w=2 | vendor-advisoryx_refsource_SUSEThird Party Advisory | |
| http://secunia.com/advisories/16431 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/16432 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/16441 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/16460 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/16465 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/16468 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/16469 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/16491 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/16550 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/16558 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/16563 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/16619 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/16635 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/16693 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/16976 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/17053 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/17066 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/17440 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://www.debian.org/security/2005/dsa-789 | vendor-advisoryx_refsource_DEBIANMailing ListThird Party Advisory | |
| http://www.debian.org/security/2005/dsa-798 | vendor-advisoryx_refsource_DEBIANMailing ListThird Party Advisory | |
| http://www.debian.org/security/2005/dsa-840 | vendor-advisoryx_refsource_DEBIANMailing List | |
| http://www.debian.org/security/2005/dsa-842 | vendor-advisoryx_refsource_DEBIANMailing ListThird Party Advisory | |
| http://www.fedoralegacy.org/updates/FC2/2005-11-28-FLSA_2005_166943__Updated_php_packages_fix_security_issues.html | vendor-advisoryx_refsource_FEDORABroken Link | |
| http://www.gentoo.org/security/en/glsa/glsa-200509-19.xml | vendor-advisoryx_refsource_GENTOOThird Party Advisory | |
| http://www.hardened-php.net/advisory_152005.67.html | x_refsource_MISCNot ApplicablePatchVendor Advisory | |
| http://www.novell.com/linux/security/advisories/2005_49_php.html | vendor-advisoryx_refsource_SUSEBroken Link | |
| http://www.redhat.com/support/errata/RHSA-2005-748.html | vendor-advisoryx_refsource_REDHATBroken Link | |
| http://www.securityfocus.com/archive/1/408125 | mailing-listx_refsource_BUGTRAQBroken LinkThird Party AdvisoryVDB Entry | |
| http://www.securityfocus.com/bid/14560 | vdb-entryx_refsource_BIDBroken LinkThird Party AdvisoryVDB Entry | |
| https://access.redhat.com/security/cve/CVE-2005-2498 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1617729 | Issue Tracking | |
| https://nvd.nist.gov/vuln/detail/CVE-2005-2498 | ||
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9569 | vdb-entrysignaturex_refsource_OVALBroken Link | |
| https://www.cve.org/CVERecord?id=CVE-2005-2498 |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Aug 15, 2005
Updated Aug 7, 2024
Reserved Aug 8, 2005
Link CVE-2005-2498
CISA Vulnrichment
Updated n/a