# CVE-2005-1921: CVE-2005-1921

- Exploited (CISA KEV): no
- Published: 2005-07-01
- CVSS: not scored
- EPSS: 79.1% (100th percentile)

Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Before feed history | — | — |
| AWS | Before feed history | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | Before feed history | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2026-10-21 | — |
| Akamai | No public source | — | — |
| OWASP CRS | Before feed history | — | — |

### F5

- 2026-10-21 · updated · rule 200100060
  > Updated: signature 200100060 "xmlrpc.php sensitive method post attempt" (Abuse of Functionality, risk Medium), systems: WordPress. References: CVE-2005-1921, CVE-2025-54352.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2005-1921 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2005-1921