Vulnerabilities

TI-2026-27082 CVE-2026-34838

Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in `AbstractSettingsCollection`

MEDIUM 45

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.01042 Published 2026-04-02 Fixed in 6.8.156, 25.0.90 +1 CWE-502

TI-2026-26134 CVE-2026-33755

Authenticated SQL Injection in Contact/query addressBookIds filter

MEDIUM 40

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00394 Published 2026-03-27 Fixed in 6.8.158, 25.0.92 +1 CWE-89

TI-2026-23471 CVE-2026-30238

Group-Office: Reflected XSS in JavaScript context

MEDIUM 56

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00314 Published 2026-03-06 Fixed in 6.8.155, 25.0.88 +1 CWE-79

TI-2026-23470 CVE-2026-30237

Group-Office: Self XSS in GroupOffice Installer License Page (install/license.php)

MEDIUM 44

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0LOW 2.1 Network No auth User interaction EPSS 0.00262 Published 2026-03-06 Fixed in 6.8.155, 25.0.88 +1 CWE-79

TI-2026-22291 CVE-2026-27947

Group-Office Vulnerable to Remote Code Execution (RCE)

MEDIUM 44

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.008 Published 2026-02-27 Fixed in 26.0.9, 25.0.87 +1 CWE-434

TI-2026-22183 CVE-2026-27832

Group-Office Has Authenticated SQL Injection in advancedQueryData.comparator

LOW 31

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00284 Published 2026-02-27 Fixed in 6.8.153, 25.0.87 +1 CWE-89

TI-2025-31121 CVE-2025-48993

Group-Office vulnerable to reflected XSS via Look and Feel Formatting input

MEDIUM 57

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00257 Published 2025-06-17 Fixed in 6.8.123, 25.0.27 CWE-79

TI-2025-31120 CVE-2025-48992

Group-Office vulnerable to blind XSS

MEDIUM 57

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0MEDIUM 5.2 Network High privileges No interaction EPSS 0.00256 Published 2025-06-16 Fixed in 6.8.123, 25.0.27 CWE-79

TI-2025-30695 CVE-2025-48369

GroupOffice vulnerable to Stored XSS in Tasks Comment Section

MEDIUM 57

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0MEDIUM 5.3 Network High privileges User interaction EPSS 0.00269 Published 2025-05-22 Fixed in 6.8.119, 25.0.20 CWE-79

TI-2025-30694 CVE-2025-48368

GroupOffice's DOM-Based XSS in all Date Input Fields Allows Arbitrary JavaScript Execution

HIGH 65

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0MEDIUM 5.8 Network No auth User interaction EPSS 0.00274 Published 2025-05-22 Fixed in 6.8.119, 25.0.20 CWE-79

TI-2025-30692 CVE-2025-48366

GroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized Actions

HIGH 70

Group-Office is an enterprise customer relationship management and groupware tool.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00289 Published 2025-05-22 Fixed in 6.8.119, 25.0.20 CWE-79

TI-2010-03261 CVE-2010-3428 · GHSA-x85p-5xmp-4v83

SQL injection vulnerability in modules/notes/json.php in Intermesh Group-Office 3.5.9…

LOW 35

SQL injection vulnerability in modules/notes/json.php in Intermesh Group-Office 3.5.9 allows remote attackers to execute arbitrary SQL commands via the category_id parameter in a category action.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.00961 Published 2010-09-16 No fix listed CWE-89

Vulnerabilities

Filters