CVE-2007-0905 [High] | Security Bypass in Php

CVE-2007-0905 is rated Moderate Risk (58.4/100): CVSS High severity, with medium exploitation likelihood (EPSS 1.62%). Review affected assets and schedule remediation.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-03-09	1.76%	1.62%	-0.13%
2	2025-12-28	0.85%	1.76%	+0.90%
3	2025-12-27	—	0.85%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-03-09

1.76%

1.62%

-0.13%

2025-12-28

0.85%

1.76%

+0.90%

2025-12-27

—

0.85%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
7.5	2.0	HIGH	`AV:N/AC:L/Au:N/C:P/I:P/A:P` Click to expand Access vector (AV:N) Can be exploited remotely over network reachability. Access complexity (AC:L) Exploitation conditions are straightforward and predictable. Authentication (AU:N) No authentication is required. Confidentiality impact (C:P) Partial confidentiality impact. Integrity impact (I:P) Partial integrity impact. Availability impact (A:P) Partial availability impact.	10.0	6.4	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

7.5

2.0

HIGH

AV:N/AC:L/Au:N/C:P/I:P/A:P Click to expand

Access vector (AV:N): Can be exploited remotely over network reachability.
Access complexity (AC:L): Exploitation conditions are straightforward and predictable.
Authentication (AU:N): No authentication is required.
Confidentiality impact (C:P): Partial confidentiality impact.
Integrity impact (I:P): Partial integrity impact.
Availability impact (A:P): Partial availability impact.

10.0

6.4

[email protected]

OS Trackers for CVE-2007-0905

vendor	priority	summary	link
`redhat`	—	—	https://access.redhat.com/security/cve/CVE-2007-0905
`ubuntu`	medium	CVE-2007-0905 medium priority: Ubuntu including 1 source packages (php5), 4 status rows across 4 suites (dapper, edgy, feisty, upstream): not-affected 2, released 2.	https://ubuntu.com/security/CVE-2007-0905

Vendor comments (NVD) for CVE-2007-0905

Red Hat (2008-04-02T00:00:00)

We do not consider these to be security issues. For more details see http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=169857#c1 and http://www.php.net/security-note.php

Affected software / configurations for CVE-2007-0905

Vendor	Product	Version	Raw CPE
php	php	3.0	cpe:2.3:a:php:php:3.0:::::::*
php	php	3.0.1	cpe:2.3:a:php:php:3.0.1:::::::*
php	php	3.0.2	cpe:2.3:a:php:php:3.0.2:::::::*
php	php	3.0.3	cpe:2.3:a:php:php:3.0.3:::::::*
php	php	3.0.4	cpe:2.3:a:php:php:3.0.4:::::::*
php	php	3.0.5	cpe:2.3:a:php:php:3.0.5:::::::*
php	php	3.0.6	cpe:2.3:a:php:php:3.0.6:::::::*
php	php	3.0.7	cpe:2.3:a:php:php:3.0.7:::::::*
php	php	3.0.8	cpe:2.3:a:php:php:3.0.8:::::::*
php	php	3.0.9	cpe:2.3:a:php:php:3.0.9:::::::*
php	php	3.0.10	cpe:2.3:a:php:php:3.0.10:::::::*
php	php	3.0.11	cpe:2.3:a:php:php:3.0.11:::::::*
php	php	3.0.12	cpe:2.3:a:php:php:3.0.12:::::::*
php	php	3.0.13	cpe:2.3:a:php:php:3.0.13:::::::*
php	php	3.0.14	cpe:2.3:a:php:php:3.0.14:::::::*
php	php	3.0.15	cpe:2.3:a:php:php:3.0.15:::::::*
php	php	3.0.16	cpe:2.3:a:php:php:3.0.16:::::::*
php	php	3.0.17	cpe:2.3:a:php:php:3.0.17:::::::*
php	php	3.0.18	cpe:2.3:a:php:php:3.0.18:::::::*
php	php	4.0	cpe:2.3:a:php:php:4.0:::::::*
php	php	4.0.1	cpe:2.3:a:php:php:4.0.1:::::::*
php	php	4.0.1	cpe:2.3:a:php:php:4.0.1:patch1::::::
php	php	4.0.1	cpe:2.3:a:php:php:4.0.1:patch2::::::
php	php	4.0.2	cpe:2.3:a:php:php:4.0.2:::::::*
php	php	4.0.3	cpe:2.3:a:php:php:4.0.3:::::::*
php	php	4.0.3	cpe:2.3:a:php:php:4.0.3:patch1::::::
php	php	4.0.4	cpe:2.3:a:php:php:4.0.4:::::::*
php	php	4.0.5	cpe:2.3:a:php:php:4.0.5:::::::*
php	php	4.0.6	cpe:2.3:a:php:php:4.0.6:::::::*
php	php	4.0.7	cpe:2.3:a:php:php:4.0.7:::::::*
php	php	4.0.7	cpe:2.3:a:php:php:4.0.7:rc1::::::
php	php	4.0.7	cpe:2.3:a:php:php:4.0.7:rc2::::::
php	php	4.0.7	cpe:2.3:a:php:php:4.0.7:rc3::::::
php	php	4.1.0	cpe:2.3:a:php:php:4.1.0:::::::*
php	php	4.1.1	cpe:2.3:a:php:php:4.1.1:::::::*
php	php	4.1.2	cpe:2.3:a:php:php:4.1.2:::::::*
php	php	4.2	cpe:2.3:a:php:php:4.2::dev:::::
php	php	4.2.0	cpe:2.3:a:php:php:4.2.0:::::::*
php	php	4.2.1	cpe:2.3:a:php:php:4.2.1:::::::*
php	php	4.2.2	cpe:2.3:a:php:php:4.2.2:::::::*
php	php	4.2.3	cpe:2.3:a:php:php:4.2.3:::::::*
php	php	4.3.0	cpe:2.3:a:php:php:4.3.0:::::::*
php	php	4.3.1	cpe:2.3:a:php:php:4.3.1:::::::*
php	php	4.3.2	cpe:2.3:a:php:php:4.3.2:::::::*
php	php	4.3.3	cpe:2.3:a:php:php:4.3.3:::::::*
php	php	4.3.4	cpe:2.3:a:php:php:4.3.4:::::::*
php	php	4.3.5	cpe:2.3:a:php:php:4.3.5:::::::*
php	php	4.3.6	cpe:2.3:a:php:php:4.3.6:::::::*
php	php	4.3.7	cpe:2.3:a:php:php:4.3.7:::::::*
php	php	4.3.8	cpe:2.3:a:php:php:4.3.8:::::::*
php	php	4.3.9	cpe:2.3:a:php:php:4.3.9:::::::*
php	php	4.3.10	cpe:2.3:a:php:php:4.3.10:::::::*
php	php	4.3.11	cpe:2.3:a:php:php:4.3.11:::::::*
php	php	4.4.0	cpe:2.3:a:php:php:4.4.0:::::::*
php	php	4.4.1	cpe:2.3:a:php:php:4.4.1:::::::*
php	php	4.4.2	cpe:2.3:a:php:php:4.4.2:::::::*
php	php	4.4.3	cpe:2.3:a:php:php:4.4.3:::::::*
php	php	4.4.4	cpe:2.3:a:php:php:4.4.4:::::::*
php	php	5.0	cpe:2.3:a:php:php:5.0:rc1::::::
php	php	5.0	cpe:2.3:a:php:php:5.0:rc2::::::
php	php	5.0	cpe:2.3:a:php:php:5.0:rc3::::::
php	php	5.0.0	cpe:2.3:a:php:php:5.0.0:::::::*
php	php	5.0.1	cpe:2.3:a:php:php:5.0.1:::::::*
php	php	5.0.2	cpe:2.3:a:php:php:5.0.2:::::::*
php	php	5.0.3	cpe:2.3:a:php:php:5.0.3:::::::*
php	php	5.0.4	cpe:2.3:a:php:php:5.0.4:::::::*
php	php	5.0.5	cpe:2.3:a:php:php:5.0.5:::::::*
php	php	5.1.0	cpe:2.3:a:php:php:5.1.0:::::::*
php	php	5.1.1	cpe:2.3:a:php:php:5.1.1:::::::*
php	php	5.1.2	cpe:2.3:a:php:php:5.1.2:::::::*
php	php	5.1.3	cpe:2.3:a:php:php:5.1.3:::::::*
php	php	5.1.4	cpe:2.3:a:php:php:5.1.4:::::::*
php	php	5.1.5	cpe:2.3:a:php:php:5.1.5:::::::*
php	php	5.1.6	cpe:2.3:a:php:php:5.1.6:::::::*
php	php	5.2.0	cpe:2.3:a:php:php:5.2.0:::::::*
trustix	secure_linux	2.2	cpe:2.3:o:trustix:secure_linux:2.2:::::::*
trustix	secure_linux	3.0	cpe:2.3:o:trustix:secure_linux:3.0:::::::*

References for CVE-2007-0905

URL	Tags
http://osvdb.org/32768
http://secunia.com/advisories/24089	Vendor Advisory
http://secunia.com/advisories/24419
http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.010.html
http://www.php.net/ChangeLog-5.php#5.2.1
http://www.php.net/releases/5_2_1.php
http://www.securityfocus.com/bid/22496	Patch
http://www.trustix.org/errata/2007/0009/
http://www.vupen.com/english/advisories/2007/0546

URL

CVE-2007-0905

Exploit prediction scoring system (EPSS) score for CVE-2007-0905

Common vulnerability scoring system (CVSS) metrics for CVE-2007-0905

Weakness enumeration for CVE-2007-0905

OS Trackers for CVE-2007-0905

Vendor comments (NVD) for CVE-2007-0905

Affected software / configurations for CVE-2007-0905

References for CVE-2007-0905