GO
Product
Group Office
15
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 4Medium 11Low 0
Watch
Add Group Office to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-25512 | 8.8 | Feb 4 | Group-Office is vulnerable to RCE due to Command Injection via TNEF Attachment Handler Affected: before 6.8.150; 25.0.1 before 25.0.82; 26.0.1 before 26.0.5 |
| CVE-2026-25134 | 8.8 | Feb 2 | Group-Office Argument Injection in MaintenanceController::actionZipLanguage Affected: before 6.8.150; 25.0.1 before 25.0.82; 26.0.1 before 26.0.5 |
| CVE-2025-63406 | 8.8 | Nov 13 | An issue in Intermesh BV GroupOffice vulnerable before v.25.0.47 and 6.8.136 allows a remote attacker to execute arbitrary code via the dbToApi() and eval() in the… Affected: before 6.8.136; 25.0.1 before 25.0.47 |
| CVE-2023-46730 | 8.8 | Nov 7 | Group-Office is an enterprise CRM and groupware tool Affected: 6.3.1 before 6.6.177; 6.7.0 before 6.7.54; 6.8.0 before 6.8.15 |
| CVE-2023-25292 | 6.1 | Apr 27 | Reflected Cross Site Scripting (XSS) in Intermesh BV Group-Office version 6.6.145, allows attackers to gain escalated privileges and gain sensitive information via the GO_LANGUAGE… Affected: 6.6.145 |
| CVE-2020-35419 | 6.1 | Apr 14 | Cross Site Scripting (XSS) in Group Office CRM 6.4.196 via the SET_LANGUAGE parameter Affected: 6.4.196 |
| CVE-2026-23887 | 5.4 | Jan 21 | Group-Office has stored XSS vulnerability via unsanitized filenames Affected: before 6.8.149; 25.0.1 before 25.0.80 |
| CVE-2025-53504 | 5.4 | Aug 21 | Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a cross-site scripting vulnerability Affected: before 6.8.119; 25.0.1 before 25.0.20 |
| CVE-2025-25191 | 5.4 | Mar 6 | Group-Office has a Stored XSS Vulnerability via user's name field Affected: 6.8.99 |
| CVE-2024-23941 | 5.4 | Feb 1 | Cross-site scripting vulnerability exists in Group Office prior to v6.6.182, prior to v6.7.64 and prior to v6.8.31, which may allow a remote authenticated attacker to execute an… Affected: before 6.6.182; 6.7.0 before 6.7.64; 6.8.0 before 6.8.31 |
| CVE-2024-22418 | 5.4 | Jan 18 | Group-Office is an enterprise CRM and groupware tool Affected: before 6.8.29 |
| CVE-2020-35418 | 5.4 | Apr 14 | Cross Site Scripting (XSS) in the contact page of Group Office CRM 6.4.196 by uploading a crafted svg file Affected: 6.4.196 |
| CVE-2025-53505 | 5.3 | Aug 21 | Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a path traversal vulnerability Affected: before 6.8.119; 25.0.1 before 25.0.20 |
| CVE-2021-28060 | 5.3 | Apr 14 | A Server-Side Request Forgery (SSRF) vulnerability in Group Office 6.4.196 allows a remote attacker to forge GET requests to arbitrary URLs via the url parameter to… Affected: 6.4.196 |
| CVE-2026-25511 | 4.9 | Feb 4 | Group-Office is vulnerable to SSRF and File Read in WOPI service discovery Affected: 6.8.0 before 6.8.150; 25.0.1 before 25.0.82; 26.0.1 before 26.0.5 |
Showing 15