GR
Product
groupoffice
16
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 1High 5Medium 11Low 0
Watch
Add groupoffice to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-30238 | 6.1 | Mar 6 | Group-Office: Reflected XSS in JavaScript context Affected: < 6.8.155; < 25.0.88; < 26.0.10 |
| CVE-2026-30237 | 6.1 | Mar 6 | Group-Office: Self XSS in GroupOffice Installer License Page (install/license.php) Affected: < 6.8.155; < 25.0.88; < 26.0.10 |
| CVE-2025-48993 | 6.1 | Jun 17 | Group-Office vulnerable to reflected XSS via Look and Feel Formatting input Affected: < 6.8.123; < 25.0.27 |
| CVE-2026-23887 | 5.4 | Jan 21 | Group-Office has stored XSS vulnerability via unsanitized filenames Affected: < 6.8.149; >= 25.0.1, < 25.0.80 |
| CVE-2025-48369 | 5.4 | May 22 | GroupOffice vulnerable to Stored XSS in Tasks Comment Section Affected: < 6.8.119; < 25.0.20 |
| CVE-2025-48368 | 5.4 | May 22 | GroupOffice's DOM-Based XSS in all Date Input Fields Allows Arbitrary JavaScript Execution Affected: < 6.8.119; < 25.0.20 |
| CVE-2025-48366 | 5.4 | May 22 | GroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized Actions Affected: < 6.8.119; < 25.0.20 |
| CVE-2025-25191 | 5.4 | Mar 6 | Group-Office has a Stored XSS Vulnerability via user's name field Affected: < 6.8.100 |
| CVE-2026-45551 | 5.1 | May 29 | Group-Office: Authenticated Stored XSS in Administrator Context via Arbitrary Cross-User Setting Write Affected: >= 26.0.1, < 26.0.25; >= 25.0.1, < 25.0.1005; < 6.8.165 |
| CVE-2026-25511 | 4.9 | Feb 4 | Group-Office is vulnerable to SSRF and File Read in WOPI service discovery Affected: < 6.8.150; < 25.0.82; < 26.0.5 |
| CVE-2025-48992 | 4.8 | Jun 16 | Group-Office vulnerable to blind XSS Affected: < 6.8.123; < 25.0.27 |
Showing 11