Medium severity · published Mar 6, 2025
CVE-2025-25191
Group-Office has a Stored XSS Vulnerability via user's name field
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
Group-Office is an enterprise CRM and groupware tool. This Stored XSS vulnerability exists where user input in the Name field is not properly sanitized before being stored. This vulnerability is fixed in 6.8.100.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
groupoffice · Intermesh
< 6.8.100 · source: vendor
GO
Group Office · Group-office
6.8.99 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-25191
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-25191
Patch
https://github.com/Intermesh/groupoffice/commit/c5c83e19a5cdf93b0e758726c97597861f1d6eda
Exploit
https://github.com/Intermesh/groupoffice/security/advisories/GHSA-j7p3-v652-p3gf
More from groupoffice
9.9
CVE-2026-34838
Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in `AbstractSettingsCollection`
8.8
CVE-2026-33755
Authenticated SQL Injection in Contact/query addressBookIds filter
8.8
CVE-2026-27947
Group-Office Vulnerable to Remote Code Execution (RCE)
8.8
CVE-2026-27832
Group-Office Has Authenticated SQL Injection in advancedQueryData.comparator
8.8
CVE-2026-25512
Group-Office is vulnerable to RCE due to Command Injection via TNEF Attachment Handler