Login Request a demo
GR
Product
groupoffice
by Intermesh · last CVE May 29, 2026
17
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Vulnerabilities17In the news0Timeline
Severity mix
Critical 1High 5Medium 11Low 0
Severity
All severities17Critical1High5Medium11Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add groupoffice to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-34838
9.9
1%
Apr 2
Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in `AbstractSettingsCollection`
Affected: < 6.8.156; < 25.0.90; < 26.0.12
CVE-2026-33755
8.8
0%
Mar 27
Authenticated SQL Injection in Contact/query addressBookIds filter
Affected: < 6.8.158; < 25.0.92; < 26.0.17
CVE-2026-27947
8.8
1%
Feb 27
Group-Office Vulnerable to Remote Code Execution (RCE)
Affected: >= 26.0.0, < 26.0.9; >= 25.0.0, < 25.0.87; < 6.8.154
CVE-2026-27832
8.8
0%
Feb 27
Group-Office Has Authenticated SQL Injection in advancedQueryData.comparator
Affected: < 6.8.153; >= 25.0.0, < 25.0.87; >= 26.0.0, < 26.0.8
CVE-2026-25512
8.8
20%
Feb 4
Group-Office is vulnerable to RCE due to Command Injection via TNEF Attachment Handler
Affected: < 6.8.150; < 25.0.82; < 26.0.5
CVE-2026-25134
8.8
1%
Feb 2
Group-Office Argument Injection in MaintenanceController::actionZipLanguage
Affected: < 6.8.150; >= 25.0.0, < 25.0.82; >= 26.0.0, < 26.0.5
CVE-2026-30238
6.1
0%
Mar 6
Group-Office: Reflected XSS in JavaScript context
Affected: < 6.8.155; < 25.0.88; < 26.0.10
CVE-2026-30237
6.1
0%
Mar 6
Group-Office: Self XSS in GroupOffice Installer License Page (install/license.php)
Affected: < 6.8.155; < 25.0.88; < 26.0.10
CVE-2025-48993
6.1
0%
Jun 17
Group-Office vulnerable to reflected XSS via Look and Feel Formatting input
Affected: < 6.8.123; < 25.0.27
CVE-2026-23887
5.4
0%
Jan 21
Group-Office has stored XSS vulnerability via unsanitized filenames
Affected: < 6.8.149; >= 25.0.1, < 25.0.80
CVE-2025-48369
5.4
0%
May 22
GroupOffice vulnerable to Stored XSS in Tasks Comment Section
Affected: < 6.8.119; < 25.0.20
CVE-2025-48368
5.4
0%
May 22
GroupOffice's DOM-Based XSS in all Date Input Fields Allows Arbitrary JavaScript Execution
Affected: < 6.8.119; < 25.0.20
CVE-2025-48366
5.4
0%
May 22
GroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized Actions
Affected: < 6.8.119; < 25.0.20
CVE-2025-25191
5.4
0%
Mar 6
Group-Office has a Stored XSS Vulnerability via user's name field
Affected: < 6.8.100
CVE-2026-45551
5.1
0%
May 29
Group-Office: Authenticated Stored XSS in Administrator Context via Arbitrary Cross-User Setting Write
Affected: >= 26.0.1, < 26.0.25; >= 25.0.1, < 25.0.1005; < 6.8.165
CVE-2026-25511
4.9
0%
Feb 4
Group-Office is vulnerable to SSRF and File Read in WOPI service discovery
Affected: < 6.8.150; < 25.0.82; < 26.0.5
CVE-2025-48992
4.8
0%
Jun 16
Group-Office vulnerable to blind XSS
Affected: < 6.8.123; < 25.0.27
Showing 17