Read the docs
TI-2010-03167 Aliases CVE-2010-3314GHSA-4rjc-mr4g-cqp6

Cross-site scripting (XSS) vulnerability in login.php in EGroupware 1.4.001+.002…

Priority LOW 26CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Cross-site scripting (XSS) vulnerability in login.php in EGroupware 1.4.001+.002; 1.6.001+.002 and possibly other versions before 1.6.003; and EPL 9.1 before 9.1.20100309 and 9.2 before 9.2.20100309; allows remote attackers to inject arbitrary web script or HTML via the lang parameter.

Why it matters now

EPSS 0.03333 88th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:egroupware:egroupware:1.4.001:*:*:*:*:*:*:*1.4.001VulnerableEGroupware
cpe:2.3:a:egroupware:egroupware:1.4.001\+.002:*:*:*:*:*:*:*1.4.001+.002VulnerableEGroupware
cpe:2.3:a:egroupware:egroupware:1.4.002:*:*:*:*:*:*:*1.4.002VulnerableEGroupware
cpe:2.3:a:egroupware:egroupware:1.6.001:*:*:*:*:*:*:*1.6.001VulnerableEGroupware
cpe:2.3:a:egroupware:egroupware:1.6.001\+.002:*:*:*:*:*:*:*1.6.001+.002VulnerableEGroupware
cpe:2.3:a:egroupware:egroupware:1.6.002:*:*:*:*:*:*:*1.6.002VulnerableEGroupware
cpe:2.3:a:egroupware:egroupware:9.1:-:commercial_epl:*:*:*:*:*9.1VulnerableEGroupware
cpe:2.3:a:egroupware:egroupware:9.2:-:commercial_epl:*:*:*:*:*9.2VulnerableEGroupware
  • cpe:2.3:a:egroupware:egroupware:1.4.001:*:*:*:*:*:*:* Versions 1.4.001 Vulnerable ·EGroupware
  • cpe:2.3:a:egroupware:egroupware:1.4.001\+.002:*:*:*:*:*:*:* Versions 1.4.001+.002 Vulnerable ·EGroupware
  • cpe:2.3:a:egroupware:egroupware:1.4.002:*:*:*:*:*:*:* Versions 1.4.002 Vulnerable ·EGroupware
  • cpe:2.3:a:egroupware:egroupware:1.6.001:*:*:*:*:*:*:* Versions 1.6.001 Vulnerable ·EGroupware
  • cpe:2.3:a:egroupware:egroupware:1.6.001\+.002:*:*:*:*:*:*:* Versions 1.6.001+.002 Vulnerable ·EGroupware
  • cpe:2.3:a:egroupware:egroupware:1.6.002:*:*:*:*:*:*:* Versions 1.6.002 Vulnerable ·EGroupware
  • cpe:2.3:a:egroupware:egroupware:9.1:-:commercial_epl:*:*:*:*:* Versions 9.1 Vulnerable ·EGroupware
  • cpe:2.3:a:egroupware:egroupware:9.2:-:commercial_epl:*:*:*:*:* Versions 9.2 Vulnerable ·EGroupware

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2010-3314
  2. 2026-10-03 Alias added: GHSA-4rjc-mr4g-cqp6

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2024-27031 EGroupware before 23.1.20240624 mishandles an ORDER BY clause. CVSS 3.1CRITICAL 9.8
  • TI-2026-17853 EGroupware has SQL Injection in Nextmatch Filter Processing CVSS 4.0HIGH 8.7
  • TI-2007-03051 Unspecified vulnerability in Walter Zorn wz_tooltip.js (aka wz_tooltips) before 4.01, as… CVSS 2.0HIGH 10.0
  • TI-2008-01961 Multiple unspecified vulnerabilities in eGroupWare before 1.4.004 have unspecified attack… CVSS 2.0HIGH 10.0
  • TI-2007-03052 Unspecified vulnerability in eGroupWare before 1.2.107-2 has unknown impact and attack… CVSS 2.0HIGH 10.0
  • TI-2010-03166 phpgwapi/js/fckeditor/editor/dialog/fck_spellerpages/spellerpages/serverscripts/spellchec… CVSS 2.0HIGH 7.5
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences