Intermesh

Records24All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical4CVSS 9.0–10.0

CVSS high6CVSS 7.0–8.9

Exploited now

Intermesh records in CISA KEV

No Intermesh vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Group-office 12 records HIGH

Records

12 records in Group-office · all components

TI-2025-30692 CVE-2025-48366

GroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized Actions

HIGH 70

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00289 Published 2025-05-22 Fixed in 6.8.119, 25.0.20 CWE-79

TI-2025-30694 CVE-2025-48368

GroupOffice's DOM-Based XSS in all Date Input Fields Allows Arbitrary JavaScript Execution

HIGH 65

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0MEDIUM 5.8 Network No auth User interaction EPSS 0.00274 Published 2025-05-22 Fixed in 6.8.119, 25.0.20 CWE-79

TI-2025-31121 CVE-2025-48993

Group-Office vulnerable to reflected XSS via Look and Feel Formatting input

MEDIUM 57

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00257 Published 2025-06-17 Fixed in 6.8.123, 25.0.27 CWE-79

TI-2025-31120 CVE-2025-48992

Group-Office vulnerable to blind XSS

MEDIUM 57

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0MEDIUM 5.2 Network High privileges No interaction EPSS 0.00256 Published 2025-06-16 Fixed in 6.8.123, 25.0.27 CWE-79

TI-2025-30695 CVE-2025-48369

GroupOffice vulnerable to Stored XSS in Tasks Comment Section

MEDIUM 57

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0MEDIUM 5.3 Network High privileges User interaction EPSS 0.00269 Published 2025-05-22 Fixed in 6.8.119, 25.0.20 CWE-79

TI-2026-23471 CVE-2026-30238

Group-Office: Reflected XSS in JavaScript context

MEDIUM 56

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00314 Published 2026-03-06 Fixed in 6.8.155, 25.0.88 +1 CWE-79

TI-2026-27082 CVE-2026-34838

Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in `AbstractSettingsCollection`

MEDIUM 45

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.01042 Published 2026-04-02 Fixed in 6.8.156, 25.0.90 +1 CWE-502

TI-2026-23470 CVE-2026-30237

Group-Office: Self XSS in GroupOffice Installer License Page (install/license.php)

MEDIUM 44

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0LOW 2.1 Network No auth User interaction EPSS 0.00262 Published 2026-03-06 Fixed in 6.8.155, 25.0.88 +1 CWE-79

TI-2026-22291 CVE-2026-27947

Group-Office Vulnerable to Remote Code Execution (RCE)

MEDIUM 44

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.008 Published 2026-02-27 Fixed in 26.0.9, 25.0.87 +1 CWE-434

TI-2026-26134 CVE-2026-33755

Authenticated SQL Injection in Contact/query addressBookIds filter

MEDIUM 40

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00394 Published 2026-03-27 Fixed in 6.8.158, 25.0.92 +1 CWE-89

TI-2010-03261 CVE-2010-3428 · GHSA-x85p-5xmp-4v83

SQL injection vulnerability in modules/notes/json.php in Intermesh Group-Office 3.5.9…

LOW 35

SQL injection vulnerability in modules/notes/json.php in Intermesh Group-Office 3.5.9 allows remote attackers to execute arbitrary SQL commands via the category_id parameter in a category action.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.00961 Published 2010-09-16 No fix listed CWE-89

TI-2026-22183 CVE-2026-27832

Group-Office Has Authenticated SQL Injection in advancedQueryData.comparator

LOW 31

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00284 Published 2026-02-27 Fixed in 6.8.153, 25.0.87 +1 CWE-89

Open these records in search →