Intermesh Group-Office vulnerabilities

CVE-2026-34838 [CRITICAL] CWE-502 CVE-2026-34838: Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.156, 25.0.90, and 26.0.12, a vulnerability in the AbstractSettingsCollection model leads to insecure deserialization when these settings are loaded. By injecting a serialized FileCookieJar object into a setting string, an authenticated attacker

CVE-2026-27947 [HIGH] CWE-88 CVE-2026-27947: Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to 26.0.9, 25.0.87, and 6.8.154 have an authenticated Remote Code Execution vulnerability in the TNEF attachment processing flow. The vulnerable path extracts attacker-controlled files from `winmail.dat` and then invokes `zip` with a shell wildcard (`*`).

CVE-2010-3428 [HIGH] CWE-89 CVE-2010-3428: SQL injection vulnerability in modules/notes/json.php in Intermesh Group-Office 3.5.9 allows remote SQL injection vulnerability in modules/notes/json.php in Intermesh Group-Office 3.5.9 allows remote attackers to execute arbitrary SQL commands via the category_id parameter in a category action.

CVE-2026-33755 [HIGH] CWE-89 CVE-2026-33755: Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.158, 25.0.92, and 26.0.17, an authenticated SQL Injection vulnerability in the JMAP `Contact/query` endpoint allows any authenticated user with basic addressbook access to extract arbitrary data from the database — including active session tokens of

CVE-2026-27832 [HIGH] CWE-89 CVE-2026-27832: Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to 26.0.8, 25.0.87, and 6.8.153 have a SQL Injection (SQLi) vulnerability, exploitable through the `advancedQueryData` parameter (`comparator` field) on an authenticated endpoint. The endpoint `index.php?r=email/template/emailSelection` processes `advanced

CVE-2026-30238 [MEDIUM] CWE-79 CVE-2026-30238: Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is a reflected XSS vulnerability in GroupOffice on the external/index flow. The f parameter (Base64 JSON) is decoded and then injected into an inline JavaScript block without strict escaping, allowing ... injection

CVE-2025-48366 [MEDIUM] CWE-79 CVE-2025-48366: Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.119 and 25.0.20, a stored and blind XSS vulnerability exists in the Phone Number field of the user profile within the GroupOffice application. This allows a malicious actor to inject persistent JavaScript payloads, which are triggered in the conte

CVE-2026-30237 [MEDIUM] CWE-79 CVE-2026-30237: Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is a reflected XSS vulnerability in the GroupOffice installer, endpoint install/license.php. The POST field license is rendered without escaping inside a , allowing a ... breakout.. This issue has been patched in v

CVE-2025-48369 [MEDIUM] CWE-79 CVE-2025-48369: Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.119 and 25.0.20, a persistent Cross-Site Scripting (XSS) vulnerability exists in Groupoffice's tasks comment functionality, allowing attackers to execute arbitrary JavaScript by uploading an file with a crafted filename. When administrators or oth

CVE-2025-48993 [MEDIUM] CWE-79 CVE-2025-48993: Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.123 and 25.0.27, a malicious JavaScript payload can be executed via the Look and Feel formatting fields. Any user can update their Look and Feel Formatting input fields, but the web application does not sanitize their input. This could result in a

CVE-2025-48368 [MEDIUM] CWE-79 CVE-2025-48368: Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.119 and 25.0.20, a DOM-based Cross-Site Scripting (XSS) vulnerability exists in the GroupOffice application, allowing attackers to execute arbitrary JavaScript code in the context of the victim's browser. This can lead to session hijacking, deface

CVE-2025-48992 [MEDIUM] CWE-79 CVE-2025-48992: Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.123 and 25.0.27, a stored and blind cross-site scripting (XSS) vulnerability exists in the Name Field of the user profile. A malicious attacker can change their name to a javascript payload, which is executed when a user adds the malicious user to