Group-office

Records17All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high3CVSS 7.0–8.9

Exploited now

Group-office records in CISA KEV

No Group-office vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Group Office 15 records HIGH Group-office Groupware 1 record LOW Groupoffice 1 record LOW

Records

17 records

TI-2026-20622 CVE-2026-25512

Group-Office is vulnerable to RCE due to Command Injection via TNEF Attachment Handler

HIGH 82

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.1986 Published 2026-02-04 Fixed in 6.8.150, 25.0.82 +1 CWE-78

TI-2026-20621 CVE-2026-25511

Group-Office is vulnerable to SSRF and File Read in WOPI service discovery

HIGH 75

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0HIGH 8.2 Network High privileges No interaction EPSS 0.00439 Published 2026-02-04 Fixed in 6.8.150, 25.0.82 +1 CWE-918

TI-2025-39300 CVE-2025-63406 · GHSA-cvvg-4vj4-874r

An issue in Intermesh BV GroupOffice vulnerable before v.25.0.47 and 6.8.136 allows a…

HIGH 73

An issue in Intermesh BV GroupOffice vulnerable before v.25.0.47 and 6.8.136 allows a remote attacker to execute arbitrary code via the dbToApi() and eval() in the FunctionField.php

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00795 Published 2025-11-13 No fix listed CWE-77

TI-2023-25213 CVE-2023-46730

Server-Side Request Forgery in groupoffice

HIGH 73

Group-Office is an enterprise CRM and groupware tool.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00595 Published 2023-11-07 Fixed in 6.6.177, 6.7.54 +1 CWE-918

TI-2025-18860 CVE-2025-25191

Group-Office has a Stored XSS Vulnerability via user's name field

HIGH 70

Group-Office is an enterprise CRM and groupware tool.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00284 Published 2025-03-06 Fixed in 6.8.100 CWE-79

TI-2023-10698 CVE-2023-25292 · GHSA-fmr6-95vp-532q

Reflected Cross Site Scripting (XSS) in Intermesh BV Group-Office version 6.6.145, allows…

MEDIUM 60

Reflected Cross Site Scripting (XSS) in Intermesh BV Group-Office version 6.6.145, allows attackers to gain escalated privileges and gain sensitive information via the GO_LANGUAGE cookie.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00585 Published 2023-04-27 No fix listed CWE-79

TI-2026-20296 CVE-2026-25134

Group-Office Argument Injection in MaintenanceController::actionZipLanguage

MEDIUM 44

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00886 Published 2026-02-02 Fixed in 6.8.150, 25.0.82 +1 CWE-88

TI-2012-03621 CVE-2012-4240 · GHSA-7gpq-4vwj-j795

SQL injection vulnerability in modules/calendar/json.php in Group-Office community before…

LOW 31

SQL injection vulnerability in modules/calendar/json.php in Group-Office community before 4.0.90 allows remote authenticated users to execute arbitrary SQL commands via the sort parameter.

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.01247 Published 2014-09-11 No fix listed CWE-89

TI-2024-14991 CVE-2024-22418

Stored Cross-site Scripting Vulnerability via Malicious File Names in GroupOffice

LOW 29

Group-Office is an enterprise CRM and groupware tool.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00424 Published 2024-01-18 Fixed in 6.8.29 CWE-79

TI-2020-17971 CVE-2020-35419 · GHSA-9682-9hwh-f3cc

Cross Site Scripting (XSS) in Group Office CRM 6.4.196 via the SET_LANGUAGE parameter.

LOW 28

Cross Site Scripting (XSS) in Group Office CRM 6.4.196 via the SET_LANGUAGE parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00667 Published 2021-04-14 No fix listed CWE-79

TI-2021-09329 CVE-2021-28060 · GHSA-46jj-588g-jh7g

A Server-Side Request Forgery (SSRF) vulnerability in Group Office 6.4.196 allows a…

LOW 27

A Server-Side Request Forgery (SSRF) vulnerability in Group Office 6.4.196 allows a remote attacker to forge GET requests to arbitrary URLs via the url parameter to group/api/upload.php.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0143 Published 2021-04-14 No fix listed CWE-918

TI-2024-15922 CVE-2024-23941 · GHSA-5rhg-f75j-57f8

Cross-site scripting in Intermesh Group Office

LOW 25

Cross-site scripting vulnerability exists in Group Office prior to v6.6.182, prior to v6.7.64 and prior to v6.8.31, which may allow a remote authenticated attacker to execute an arbitrary script on the web browser of the…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00618 Published 2024-02-01 Fixed in v6.6.182, v6.7.64 +1 CWE-79

TI-2020-17970 CVE-2020-35418 · GHSA-24pg-mpvf-gg4c

Cross Site Scripting (XSS) in the contact page of Group Office CRM 6.4.196 by uploading a crafted svg file.

LOW 25

Cross Site Scripting (XSS) in the contact page of Group Office CRM 6.4.196 by uploading a crafted svg file.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00524 Published 2021-04-14 No fix listed CWE-79

TI-2025-33450 CVE-2025-53505 · GHSA-xx3q-q45w-hjq8

Path traversal in Intermesh Group-Office

LOW 24

Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a path traversal vulnerability.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00342 Published 2025-08-21 Fixed in 6.8.119, 25.0.20 CWE-22

TI-2026-19245 CVE-2026-23887

Group-Office has stored XSS vulnerability via unsanitized filenames

LOW 23

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00274 Published 2026-01-21 Fixed in 6.8.149, 25.0.80 CWE-20

TI-2007-02631 CVE-2007-2720 · GHSA-jf2x-r8ch-mw45

Group-Office before 2.16-13 does not properly validate user IDs, which allows remote…

LOW 22

Group-Office before 2.16-13 does not properly validate user IDs, which allows remote attackers to obtain sensitive information via certain requests for (1) message.php and (2) messages.php in modules/email/.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01105 Published 2007-05-16 No fix listed

TI-2025-33449 CVE-2025-53504 · GHSA-5j42-cmx3-349c

Cross-site scripting in Intermesh Group-Office

LOW 21

Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a cross-site scripting vulnerability.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00188 Published 2025-08-21 Fixed in 6.8.119, 25.0.20 CWE-79

Open these records in search →