GR
Product
Group-Office
13
CVEs
0
On KEV
9.9
Max CVSS
1
New 30D
Severity mix
Critical 1High 4Medium 7Low 0
Watch
Add Group-Office to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-34838 | 9.9 | Apr 2 | Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in `AbstractSettingsCollection` Affected: before 6.8.156; 25.0.1 before 25.0.90; 26.0.1 before 26.0.12 |
| CVE-2026-33755 | 8.8 | Mar 27 | Authenticated SQL Injection in Contact/query addressBookIds filter Affected: before 6.8.158; 25.0.1 before 25.0.92; 26.0.1 before 26.0.17 |
| CVE-2026-27947 | 8.8 | Feb 27 | Group-Office Vulnerable to Remote Code Execution (RCE) Affected: before 6.8.154; 25.0.1 before 25.0.87; 26.0.1 before 26.0.9 |
| CVE-2026-27832 | 8.8 | Feb 27 | Group-Office Has Authenticated SQL Injection in advancedQueryData.comparator Affected: before 6.8.153; 25.0.1 before 25.0.87; 26.0.1 before 26.0.8 |
| CVE-2018-25438 New | 7.5 | Oct 22 | Intermesh Group-Office < 3.5.5 Path Traversal via compress.php Affected: 3.3.0 before 3.5.5 |
| CVE-2026-30238 | 6.1 | Mar 6 | Group-Office: Reflected XSS in JavaScript context Affected: before 6.8.155; 25.0.1 before 25.0.88; 25.2.1 before 26.0.10 |
| CVE-2026-30237 | 6.1 | Mar 6 | Group-Office: Self XSS in GroupOffice Installer License Page (install/license.php) Affected: before 6.8.155; 25.0.1 before 25.0.88; 25.2.1 before 26.0.10 |
| CVE-2025-48993 | 6.1 | Jun 17 | Group-Office vulnerable to reflected XSS via Look and Feel Formatting input Affected: before 6.8.123; 25.0.1 before 25.0.27 |
| CVE-2025-48369 | 5.4 | May 22 | GroupOffice vulnerable to Stored XSS in Tasks Comment Section Affected: before 6.8.199; 25.0.1 before 25.0.20 |
| CVE-2025-48368 | 5.4 | May 22 | GroupOffice's DOM-Based XSS in all Date Input Fields Allows Arbitrary JavaScript Execution Affected: before 6.8.199; 25.0.1 before 25.0.20 |
| CVE-2025-48366 | 5.4 | May 22 | GroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized Actions Affected: before 6.8.199; 25.0.1 before 25.0.20 |
| CVE-2025-48992 | 4.8 | Jun 16 | Group-Office vulnerable to blind XSS Affected: before 6.8.123; 25.0.1 before 25.0.27 |
| CVE-2010-3428 | – | Sep 16 | SQL injection vulnerability in modules/notes/json.php in Intermesh Group-Office 3.5.9 allows remote attackers to execute arbitrary SQL commands via the category_id parameter in a… Affected: 3.5.9 |
Showing 13