Every CVE Search/ Get API key

CVE-2005-1924

The G/PGP (GPG) Plugin 2.1 and earlier for Squirrelmail allow remote authenticated users to...

9.3 HighPublic exploit

The G/PGP (GPG) Plugin 2.1 and earlier for Squirrelmail allow remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the fpr parameter to the deleteKey function in gpg_keyring.php, as called by (a) import_key_file.php, (b) import_key_text.php, and (c) keyring_main.php; and (2) the keyserver parameter to the gpg_recv_key function in gpg_key_functions.php, as called by gpg_options.php. NOTE: this issue may overlap CVE-2007-3636.

Exploit likelihood

10.3%Down 2.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 9.3

The G/PGP (GPG) Plugin 2.1 and earlier for Squirrelmail allow remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the fpr parameter to the deleteKey function in gpg_keyring.php, as called by (a) import_key_file.php, (b) import_key_text.php, and (c) keyring_main.php; and (2) the keyserver parameter to the gpg_recv_key function in gpg_key_functions.php, as called by gpg_options.php. NOTE: this issue may overlap CVE-2007-3636.

Record
CVE-2005-1924
CVSS 2.0
9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Updated
2026-11-02
CVE List No score

The G/PGP (GPG) Plugin 2.1 and earlier for Squirrelmail allow remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the fpr parameter to the deleteKey function in gpg_keyring.php, as called by (a) import_key_file.php, (b) import_key_text.php, and (c) keyring_main.php; and (2) the keyserver parameter to the gpg_recv_key function in gpg_key_functions.php, as called by gpg_options.php. NOTE: this issue may overlap CVE-2007-3636.

Record
CVE-2005-1924
Updated
2026-11-02
EUVDEUVD-2005-1926 No score

The G/PGP (GPG) Plugin 2.1 and earlier for Squirrelmail allow remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the fpr parameter to the deleteKey function in gpg_keyring.php, as called by (a) import_key_file.php, (b) import_key_text.php, and (c) keyring_main.php; and (2) the keyserver parameter to the gpg_recv_key function in gpg_key_functions.php, as called by gpg_options.php. NOTE: this issue may overlap CVE-2007-3636.

Record
EUVD-2005-1926
Updated
2026-11-03
GitHub AdvisoriesGHSA-87rp-52qv-ghjc No score

The G/PGP (GPG) Plugin 2.1 and earlier for Squirrelmail allow remote authenticated users to...

The G/PGP (GPG) Plugin 2.1 and earlier for Squirrelmail allow remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the fpr parameter to the deleteKey function in gpg_keyring.php, as called by (a) import_key_file.php, (b) import_key_text.php, and (c) keyring_main.php; and (2) the keyserver parameter to the gpg_recv_key function in gpg_key_functions.php, as called by gpg_options.php. NOTE: this issue may overlap CVE-2007-3636.

Record
GHSA-87rp-52qv-ghjc
Updated
2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBSquirrelMail G/PGP Encryption Plugin 2.0 - Command Execution2007-07-11
Exploit-DBSquirrelMail G/PGP Encryption Plugin - 'deletekey()' Command Injection2007-12-11

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2005-1924 is a high vulnerability (CVSS 9.3) in Squirrelmail Gpg Plugin, published December 31, 2005. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 10.3%, the 95th percentile. No source names a fixed version.

References

Show 10 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open