GR
Vendor
Group-office
17
CVEs
0
On KEV
0
New 30D
Products
GO8.8
Group Office
Group-office
15 CVEs0 on KEV0 new
GG–
Group-office Groupware
Group-office
1 CVEs0 on KEV0 new
GR–
Groupoffice
Group-office
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-25511 | GO Group Office Group-office | 4.9 | Feb 4 | Group-Office is vulnerable to SSRF and File Read in WOPI service discovery |
| CVE-2026-25512 | GO Group Office Group-office | 8.8 | Feb 4 | Group-Office is vulnerable to RCE due to Command Injection via TNEF Attachment Handler |
| CVE-2026-25134 | GO Group Office Group-office | 8.8 | Feb 2 | Group-Office Argument Injection in MaintenanceController::actionZipLanguage |
| CVE-2026-23887 | GO Group Office Group-office | 5.4 | Jan 21 | Group-Office has stored XSS vulnerability via unsanitized filenames |
| CVE-2025-63406 | GO Group Office Group-office | 8.8 | Nov 13 | An issue in Intermesh BV GroupOffice vulnerable before v.25.0.47 and 6.8.136 allows a remote attacker to execute arbitrary code via the dbToApi() and eval() in the… |
| CVE-2025-53505 | GO Group Office Group-office | 5.3 | Aug 21 | Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a path traversal vulnerability |
| CVE-2025-53504 | GO Group Office Group-office | 5.4 | Aug 21 | Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a cross-site scripting vulnerability |
| CVE-2025-25191 | GO Group Office Group-office | 5.4 | Mar 6 | Group-Office has a Stored XSS Vulnerability via user's name field |
| CVE-2024-23941 | GO Group Office Group-office | 5.4 | Feb 1 | Cross-site scripting vulnerability exists in Group Office prior to v6.6.182, prior to v6.7.64 and prior to v6.8.31, which may allow a remote authenticated attacker to execute an… |
| CVE-2024-22418 | GO Group Office Group-office | 5.4 | Jan 18 | Stored Cross-site Scripting Vulnerability via Malicious File Names in GroupOffice |
| CVE-2023-46730 | GO Group Office Group-office | 8.8 | Nov 7 | Group-Office is an enterprise CRM and groupware tool |
| CVE-2023-25292 | GO Group Office Group-office | 6.1 | Apr 27 | Reflected Cross Site Scripting (XSS) in Intermesh BV Group-Office version 6.6.145, allows attackers to gain escalated privileges and gain sensitive information via the GO_LANGUAGE… |
| CVE-2021-28060 | GO Group Office Group-office | 5.3 | Apr 14 | A Server-Side Request Forgery (SSRF) vulnerability in Group Office 6.4.196 allows a remote attacker to forge GET requests to arbitrary URLs via the url parameter to… |
| CVE-2020-35419 | GO Group Office Group-office | 6.1 | Apr 14 | Cross Site Scripting (XSS) in Group Office CRM 6.4.196 via the SET_LANGUAGE parameter |
| CVE-2020-35418 | GO Group Office Group-office | 5.4 | Apr 14 | Cross Site Scripting (XSS) in the contact page of Group Office CRM 6.4.196 by uploading a crafted svg file |
| CVE-2012-4240 | GR Groupoffice Group-office | – | Sep 11 | SQL injection vulnerability in modules/calendar/json.php in Group-Office community before 4.0.90 allows remote authenticated users to execute arbitrary SQL commands via the sort… |
| CVE-2007-2720 | GG Group-office Groupware Group-office | – | May 16 | Group-Office before 2.16-13 does not properly validate user IDs, which allows remote attackers to obtain sensitive information via certain requests for (1) message.php and (2)… |