Intermesh

Records24All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical4CVSS 9.0–10.0

CVSS high6CVSS 7.0–8.9

Exploited now

Intermesh records in CISA KEV

No Intermesh vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Group-office 12 records HIGH

Records

24 records

TI-2026-20622 CVE-2026-25512

Group-Office is vulnerable to RCE due to Command Injection via TNEF Attachment Handler

HIGH 82

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.1986 Published 2026-02-04 Fixed in 6.8.150, 25.0.82 +1 CWE-78

TI-2018-16194 CVE-2018-25438 · GHSA-vvmf-fxj8-j775

Path traversal in Intermesh Group-Office lets attackers read files

HIGH 77

Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00536 Published 2026-10-22 Fixed in 3.5.5 CWE-22

TI-2026-20621 CVE-2026-25511

Group-Office is vulnerable to SSRF and File Read in WOPI service discovery

HIGH 75

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0HIGH 8.2 Network High privileges No interaction EPSS 0.00439 Published 2026-02-04 Fixed in 6.8.150, 25.0.82 +1 CWE-918

TI-2023-25213 CVE-2023-46730

Server-Side Request Forgery in groupoffice

HIGH 73

Group-Office is an enterprise CRM and groupware tool.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00595 Published 2023-11-07 Fixed in 6.6.177, 6.7.54 +1 CWE-918

TI-2025-30692 CVE-2025-48366

GroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized Actions

HIGH 70

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00289 Published 2025-05-22 Fixed in 6.8.119, 25.0.20 CWE-79

TI-2025-18860 CVE-2025-25191

Group-Office has a Stored XSS Vulnerability via user's name field

HIGH 70

Group-Office is an enterprise CRM and groupware tool.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00284 Published 2025-03-06 Fixed in 6.8.100 CWE-79

TI-2025-30694 CVE-2025-48368

GroupOffice's DOM-Based XSS in all Date Input Fields Allows Arbitrary JavaScript Execution

HIGH 65

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0MEDIUM 5.8 Network No auth User interaction EPSS 0.00274 Published 2025-05-22 Fixed in 6.8.119, 25.0.20 CWE-79

TI-2025-31121 CVE-2025-48993

Group-Office vulnerable to reflected XSS via Look and Feel Formatting input

MEDIUM 57

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00257 Published 2025-06-17 Fixed in 6.8.123, 25.0.27 CWE-79

TI-2025-31120 CVE-2025-48992

Group-Office vulnerable to blind XSS

MEDIUM 57

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0MEDIUM 5.2 Network High privileges No interaction EPSS 0.00256 Published 2025-06-16 Fixed in 6.8.123, 25.0.27 CWE-79

TI-2025-30695 CVE-2025-48369

GroupOffice vulnerable to Stored XSS in Tasks Comment Section

MEDIUM 57

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0MEDIUM 5.3 Network High privileges User interaction EPSS 0.00269 Published 2025-05-22 Fixed in 6.8.119, 25.0.20 CWE-79

TI-2026-33300 CVE-2026-45551

Group-Office: Authenticated Stored XSS in Administrator Context via Arbitrary Cross-User Setting Write

MEDIUM 56

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.0023 Published 2026-05-29 Fixed in 26.0.25, 25.0.1005 +1 CWE-639

TI-2026-23471 CVE-2026-30238

Group-Office: Reflected XSS in JavaScript context

MEDIUM 56

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00314 Published 2026-03-06 Fixed in 6.8.155, 25.0.88 +1 CWE-79

TI-2026-27082 CVE-2026-34838

Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in `AbstractSettingsCollection`

MEDIUM 45

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.01042 Published 2026-04-02 Fixed in 6.8.156, 25.0.90 +1 CWE-502

TI-2026-23470 CVE-2026-30237

Group-Office: Self XSS in GroupOffice Installer License Page (install/license.php)

MEDIUM 44

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0LOW 2.1 Network No auth User interaction EPSS 0.00262 Published 2026-03-06 Fixed in 6.8.155, 25.0.88 +1 CWE-79

TI-2026-22291 CVE-2026-27947

Group-Office Vulnerable to Remote Code Execution (RCE)

MEDIUM 44

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.008 Published 2026-02-27 Fixed in 26.0.9, 25.0.87 +1 CWE-434

TI-2026-20296 CVE-2026-25134

Group-Office Argument Injection in MaintenanceController::actionZipLanguage

MEDIUM 44

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00886 Published 2026-02-02 Fixed in 6.8.150, 25.0.82 +1 CWE-88

TI-2026-26134 CVE-2026-33755

Authenticated SQL Injection in Contact/query addressBookIds filter

MEDIUM 40

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00394 Published 2026-03-27 Fixed in 6.8.158, 25.0.92 +1 CWE-89

TI-2010-03261 CVE-2010-3428 · GHSA-x85p-5xmp-4v83

SQL injection vulnerability in modules/notes/json.php in Intermesh Group-Office 3.5.9…

LOW 35

SQL injection vulnerability in modules/notes/json.php in Intermesh Group-Office 3.5.9 allows remote attackers to execute arbitrary SQL commands via the category_id parameter in a category action.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.00961 Published 2010-09-16 No fix listed CWE-89

TI-2026-22183 CVE-2026-27832

Group-Office Has Authenticated SQL Injection in advancedQueryData.comparator

LOW 31

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00284 Published 2026-02-27 Fixed in 6.8.153, 25.0.87 +1 CWE-89

TI-2024-14991 CVE-2024-22418

Stored Cross-site Scripting Vulnerability via Malicious File Names in GroupOffice

LOW 29

Group-Office is an enterprise CRM and groupware tool.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00424 Published 2024-01-18 Fixed in 6.8.29 CWE-79

TI-2024-15922 CVE-2024-23941 · GHSA-5rhg-f75j-57f8

Cross-site scripting in Intermesh Group Office

LOW 25

Cross-site scripting vulnerability exists in Group Office prior to v6.6.182, prior to v6.7.64 and prior to v6.8.31, which may allow a remote authenticated attacker to execute an arbitrary script on the web browser of the…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00618 Published 2024-02-01 Fixed in v6.6.182, v6.7.64 +1 CWE-79

TI-2025-33450 CVE-2025-53505 · GHSA-xx3q-q45w-hjq8

Path traversal in Intermesh Group-Office

LOW 24

Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a path traversal vulnerability.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00342 Published 2025-08-21 Fixed in 6.8.119, 25.0.20 CWE-22

TI-2026-19245 CVE-2026-23887

Group-Office has stored XSS vulnerability via unsanitized filenames

LOW 23

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00274 Published 2026-01-21 Fixed in 6.8.149, 25.0.80 CWE-20

TI-2025-33449 CVE-2025-53504 · GHSA-5j42-cmx3-349c

Cross-site scripting in Intermesh Group-Office

LOW 21

Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a cross-site scripting vulnerability.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00188 Published 2025-08-21 Fixed in 6.8.119, 25.0.20 CWE-79

Open these records in search →