Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-fn24-qm2c-eqef
Vulnerability ID VCID-fn24-qm2c-eqef
Aliases CVE-2010-3313
GHSA-5gx6-f2qq-475f
Summary EGroupware Code Injection vulnerability `phpgwapi/js/fckeditor/editor/dialog/fck_spellerpages/spellerpages/serverscripts/spellchecker.php` in EGroupware 1.4.001+.002; 1.6.001+.002 and possibly other versions before 1.6.003; and EPL 9.1 before 9.1.20100309 and 9.2 before 9.2.20100309; allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) aspell_path or (2) spellchecker_lang parameters.
Status Published
Exploitability 2.0
Weighted Severity 8.0
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.023 https://api.first.org/data/v1/epss?cve=CVE-2010-3313
epss 0.023 https://api.first.org/data/v1/epss?cve=CVE-2010-3313
epss 0.023 https://api.first.org/data/v1/epss?cve=CVE-2010-3313
epss 0.023 https://api.first.org/data/v1/epss?cve=CVE-2010-3313
epss 0.023 https://api.first.org/data/v1/epss?cve=CVE-2010-3313
epss 0.023 https://api.first.org/data/v1/epss?cve=CVE-2010-3313
epss 0.023 https://api.first.org/data/v1/epss?cve=CVE-2010-3313
epss 0.023 https://api.first.org/data/v1/epss?cve=CVE-2010-3313
epss 0.023 https://api.first.org/data/v1/epss?cve=CVE-2010-3313
epss 0.023 https://api.first.org/data/v1/epss?cve=CVE-2010-3313
epss 0.023 https://api.first.org/data/v1/epss?cve=CVE-2010-3313
epss 0.023 https://api.first.org/data/v1/epss?cve=CVE-2010-3313
epss 0.023 https://api.first.org/data/v1/epss?cve=CVE-2010-3313
epss 0.023 https://api.first.org/data/v1/epss?cve=CVE-2010-3313
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-5gx6-f2qq-475f
cvssv4 8.9 https://github.com/EGroupware/egroupware
generic_textual HIGH https://github.com/EGroupware/egroupware
cvssv2 7.5 https://nvd.nist.gov/vuln/detail/CVE-2010-3313
cvssv4 8.9 https://nvd.nist.gov/vuln/detail/CVE-2010-3313
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2010-3313
cvssv4 8.9 http://www.debian.org/security/2010/dsa-2013
generic_textual HIGH http://www.debian.org/security/2010/dsa-2013
cvssv4 8.9 http://www.egroupware.org/news?item=93
generic_textual HIGH http://www.egroupware.org/news?item=93
cvssv4 8.9 http://www.exploit-db.com/exploits/11777
generic_textual HIGH http://www.exploit-db.com/exploits/11777
cvssv4 8.9 http://www.openwall.com/lists/oss-security/2010/09/21/7
generic_textual HIGH http://www.openwall.com/lists/oss-security/2010/09/21/7
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2010-3313
https://github.com/EGroupware/egroupware
https://nvd.nist.gov/vuln/detail/CVE-2010-3313
http://www.debian.org/security/2010/dsa-2013
http://www.egroupware.org/news?item=93
http://www.exploit-db.com/exploits/11777
http://www.exploit-db.com/exploits/11777/
http://www.openwall.com/lists/oss-security/2010/09/21/7
cpe:2.3:a:egroupware:egroupware:1.4.001:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:egroupware:egroupware:1.4.001:*:*:*:*:*:*:*
cpe:2.3:a:egroupware:egroupware:1.4.001\+.002:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:egroupware:egroupware:1.4.001\+.002:*:*:*:*:*:*:*
cpe:2.3:a:egroupware:egroupware:1.4.002:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:egroupware:egroupware:1.4.002:*:*:*:*:*:*:*
cpe:2.3:a:egroupware:egroupware:1.6.001:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:egroupware:egroupware:1.6.001:*:*:*:*:*:*:*
cpe:2.3:a:egroupware:egroupware:1.6.001\+.002:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:egroupware:egroupware:1.6.001\+.002:*:*:*:*:*:*:*
cpe:2.3:a:egroupware:egroupware:1.6.002:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:egroupware:egroupware:1.6.002:*:*:*:*:*:*:*
cpe:2.3:a:egroupware:egroupware:9.1:-:commercial_epl:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:egroupware:egroupware:9.1:-:commercial_epl:*:*:*:*:*
cpe:2.3:a:egroupware:egroupware:9.2:-:commercial_epl:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:egroupware:egroupware:9.2:-:commercial_epl:*:*:*:*:*
CVE-2010-3314;CVE-2010-3313;OSVDB-62805;OSVDB-62804 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/11777.txt
GHSA-5gx6-f2qq-475f https://github.com/advisories/GHSA-5gx6-f2qq-475f
GLSA-201412-10 https://security.gentoo.org/glsa/201412-10
Data source Exploit-DB
Date added March 15, 2010
Description eGroupWare 1.6.002 and eGroupWare premium line 9.1 - Multiple Vulnerabilities
Ransomware campaign use Known
Source publication date March 16, 2010
Exploit type webapps
Platform php
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/EGroupware/egroupware
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2010-3313
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://nvd.nist.gov/vuln/detail/CVE-2010-3313
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at http://www.debian.org/security/2010/dsa-2013
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at http://www.egroupware.org/news?item=93
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at http://www.exploit-db.com/exploits/11777
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at http://www.openwall.com/lists/oss-security/2010/09/21/7
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.84663
EPSS Score 0.023
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:11:12.585065+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-5gx6-f2qq-475f/GHSA-5gx6-f2qq-475f.json 38.0.0