GHSA-ww6p-q26w-fr6m

phpxmlrpc/extra XSS in class documenting_xmlrpc_server

6.1 MediumFix available

GHSA-ww6p-q26w-fr6m is a medium vulnerability (CVSS 6.1) in phpxmlrpc/extras, published May 20, 2024. No source lists public exploit code. Fixed in phpxmlrpc/extras 0.6.1.

What does this mean?

Severity: 6.1 MediumCVSS 3.1, GitHub Advisories
Exploit chance: UnscoredNo EPSS score yet
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 0.6.1phpxmlrpc/extras +1 more

Description

Versions preceding 0.6.1 of the phpxmlrpc/extras project are susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability exists within the class documenting_xmlrpc_server when processing the GET methodName parameter.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Affected packages

Affected packages
Package	Affected	Fixed
`phpxmlrpc/extras` Packagist	before 0.6.1	0.6.1
`phpxmlrpc/extras` Packagist	before 0.6.1, plus listed versions 0.5.10.5.20.6.0	0.6.1

What each source reports

GitHub Advisories Score used6.1

phpxmlrpc/extra XSS in class documenting_xmlrpc_server

Record: GHSA-ww6p-q26w-fr6m
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-80
Updated: 2026-11-02

OSV6.1