TI-2026-20622 CVE-2026-25512
Group-Office is vulnerable to RCE due to Command Injection via TNEF Attachment Handler
Priority HIGH 82
Group-Office is an enterprise customer relationship management and groupware tool.
Group-office
Records17All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
Group-office records in CISA KEVNo Group-office vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
15 records in Group Office · all components
TI-2026-20621 CVE-2026-25511
Group-Office is vulnerable to SSRF and File Read in WOPI service discovery
Priority HIGH 75
Group-Office is an enterprise customer relationship management and groupware tool.
TI-2025-39300 CVE-2025-63406 · GHSA-cvvg-4vj4-874r
An issue in Intermesh BV GroupOffice vulnerable before v.25.0.47 and 6.8.136 allows a…
Priority HIGH 73
An issue in Intermesh BV GroupOffice vulnerable before v.25.0.47 and 6.8.136 allows a remote attacker to execute arbitrary code via the dbToApi() and eval() in the FunctionField.php
TI-2023-25213 CVE-2023-46730
Server-Side Request Forgery in groupoffice
Priority HIGH 73
Group-Office is an enterprise CRM and groupware tool.
Priority HIGH 70
Group-Office is an enterprise CRM and groupware tool.
TI-2023-10698 CVE-2023-25292 · GHSA-fmr6-95vp-532q
Reflected Cross Site Scripting (XSS) in Intermesh BV Group-Office version 6.6.145, allows…
Priority MEDIUM 60
Reflected Cross Site Scripting (XSS) in Intermesh BV Group-Office version 6.6.145, allows attackers to gain escalated privileges and gain sensitive information via the GO_LANGUAGE cookie.
TI-2026-20296 CVE-2026-25134
Group-Office Argument Injection in MaintenanceController::actionZipLanguage
Priority MEDIUM 44
Group-Office is an enterprise customer relationship management and groupware tool.
TI-2024-14991 CVE-2024-22418
Stored Cross-site Scripting Vulnerability via Malicious File Names in GroupOffice
Priority LOW 29
Group-Office is an enterprise CRM and groupware tool.
TI-2020-17971 CVE-2020-35419 · GHSA-9682-9hwh-f3cc
Cross Site Scripting (XSS) in Group Office CRM 6.4.196 via the SET_LANGUAGE parameter.
Priority LOW 28
Cross Site Scripting (XSS) in Group Office CRM 6.4.196 via the SET_LANGUAGE parameter.
TI-2021-09329 CVE-2021-28060 · GHSA-46jj-588g-jh7g
A Server-Side Request Forgery (SSRF) vulnerability in Group Office 6.4.196 allows a…
Priority LOW 27
A Server-Side Request Forgery (SSRF) vulnerability in Group Office 6.4.196 allows a remote attacker to forge GET requests to arbitrary URLs via the url parameter to group/api/upload.php.
TI-2024-15922 CVE-2024-23941 · GHSA-5rhg-f75j-57f8
Cross-site scripting in Intermesh Group Office
Priority LOW 25
Cross-site scripting vulnerability exists in Group Office prior to v6.6.182, prior to v6.7.64 and prior to v6.8.31, which may allow a remote authenticated attacker to execute an arbitrary script on the web browser of the…
TI-2020-17970 CVE-2020-35418 · GHSA-24pg-mpvf-gg4c
Cross Site Scripting (XSS) in the contact page of Group Office CRM 6.4.196 by uploading a crafted svg file.
Priority LOW 25
Cross Site Scripting (XSS) in the contact page of Group Office CRM 6.4.196 by uploading a crafted svg file.
TI-2025-33450 CVE-2025-53505 · GHSA-xx3q-q45w-hjq8
Path traversal in Intermesh Group-Office
Priority LOW 24
Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a path traversal vulnerability.
Priority LOW 23
Group-Office is an enterprise customer relationship management and groupware tool.
TI-2025-33449 CVE-2025-53504 · GHSA-5j42-cmx3-349c
Cross-site scripting in Intermesh Group-Office
Priority LOW 21
Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a cross-site scripting vulnerability.