CVE-2013-3631
NAS4Free 9.1.0.1.804 and earlier allows remote authenticated users to execute arbitrary PHP code...
NAS4Free 9.1.0.1.804 and earlier allows remote authenticated users to execute arbitrary PHP code via a request to exec.php, aka the "Advanced | Execute Command" feature. NOTE: this issue might not be a vulnerability, since it appears to be part of legitimate, intentionally-exposed functionality by the developer and is allowed within the intended security policy.
Exploit likelihood
What each source reports
NVD Score used
NAS4Free 9.1.0.1.804 and earlier allows remote authenticated users to execute arbitrary PHP code via a request to exec.php, aka the "Advanced | Execute Command" feature. NOTE: this issue might not be a vulnerability, since it appears to be part of legitimate, intentionally-exposed functionality by the developer and is allowed within the intended security policy.
- Record
CVE-2013-3631- CVSS 2.0
- 6.0 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:P - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
NAS4Free 9.1.0.1.804 and earlier allows remote authenticated users to execute arbitrary PHP code via a request to exec.php, aka the "Advanced | Execute Command" feature. NOTE: this issue might not be a vulnerability, since it appears to be part of legitimate, intentionally-exposed functionality by the developer and is allowed within the intended security policy.
- Record
CVE-2013-3631- Updated
- 2026-11-02
EUVDEUVD-2013-3564 No score
NAS4Free 9.1.0.1.804 and earlier allows remote authenticated users to execute arbitrary PHP code via a request to exec.php, aka the "Advanced | Execute Command" feature. NOTE: this issue might not be a vulnerability, since it appears to be part of legitimate, intentionally-exposed functionality by the developer and is allowed within the intended security policy.
- Record
EUVD-2013-3564- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vc2c-9gp5-2p2q No score
NAS4Free 9.1.0.1.804 and earlier allows remote authenticated users to execute arbitrary PHP code...
NAS4Free 9.1.0.1.804 and earlier allows remote authenticated users to execute arbitrary PHP code via a request to exec.php, aka the "Advanced | Execute Command" feature. NOTE: this issue might not be a vulnerability, since it appears to be part of legitimate, intentionally-exposed functionality by the developer and is allowed within the intended security policy.
- Record
GHSA-vc2c-9gp5-2p2q- Weakness
- CWE-94
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | NAS4Free - Remote Code Execution (Metasploit) | 2013-10-31 |
| Metasploit | NAS4Free Arbitrary Remote Code Execution | 2013-10-30 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-3631 is a medium vulnerability (CVSS 6.0) in Nas4free, published November 2, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 13.7%, the 96th percentile. No source names a fixed version.