GHSA-pxqj-xrv5-qvjf
XML-RPC for PHP's debugger vulnerable to possible XSS attack
GHSA-pxqj-xrv5-qvjf is a vulnerability with no CVSS score yet in phpxmlrpc/phpxmlrpc, published January 11, 2023. No source lists public exploit code. Fixed in phpxmlrpc/phpxmlrpc 4.9.2.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
4.9.2phpxmlrpc/phpxmlrpc +1 more
Description
The bundled xml-rpc debugger is susceptible to XSS attacks.
Since the debugger is not designed to be exposed to end users but only to the developers using this library, and in the default configuration it is not exposed to requests from the web, the likelihood of exploitation may be low.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
phpxmlrpc/phpxmlrpcPackagist | before 4.9.2 | 4.9.2 |
phpxmlrpc/phpxmlrpcPackagist | before 4.9.2, plus listed versions 3.0.03.0.13.1.03.1.13.1.2 Show 27 moreShow less4.0.04.0.0-alpha4.0.14.1.04.1.14.2.04.2.14.2.24.3.04.3.14.3.24.4.04.4.14.4.24.4.34.5.04.5.14.5.24.6.04.6.14.7.04.7.14.7.24.8.04.8.14.9.04.9.1 | 4.9.2 |
What each source reports
GitHub AdvisoriesNo score
XML-RPC for PHP's debugger vulnerable to possible XSS attack
The bundled xml-rpc debugger is susceptible to XSS attacks.
Since the debugger is not designed to be exposed to end users but only to the developers using this library, and in the default configuration it is not exposed to requests from the web, the likelihood of exploitation may be low.
- Record
GHSA-pxqj-xrv5-qvjf- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVNo score
XML-RPC for PHP's debugger vulnerable to possible XSS attack
The bundled xml-rpc debugger is susceptible to XSS attacks.
Since the debugger is not designed to be exposed to end users but only to the developers using this library, and in the default configuration it is not exposed to requests from the web, the likelihood of exploitation may be low.
- Record
GHSA-pxqj-xrv5-qvjf- Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.