Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
21 results
May 29, 2026Group-Office is an enterprise customer relationship management and groupware tool.CVE-2026-45551 · Other software · Intermesh · reported by GitHubMedium 5.1
Group-Office is an enterprise customer relationship management and groupware tool. Prior to 26.0.25, 25.0.100, and 6.8.165, GroupOffice allows authenticated users to persist arbitrary legacy settings for any user_id via index.php?r=core/saveSetting. A separate client-side sink in the email module injects the email_font_size setting directly into JavaScript without escaping. By combining these two issues, any low-privileged authenticated user can overwrite an administrator's email_font_size setting with a JavaScript payload and trigger stored XSS in the administrator's browser when the GroupOffice web client loads views/Extjs3/modulescripts.php. This vulnerability is fixed in 26.0.25, 25.0.100, and 6.8.165.
- Product
- groupoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026Group-Office is an enterprise customer relationship management and groupware tool.CVE-2026-34838 · Other software · Intermesh · reported by GitHubCritical 9.9
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.156, 25.0.90, and 26.0.12, a vulnerability in the AbstractSettingsCollection model leads to insecure deserialization when these settings are loaded. By injecting a serialized FileCookieJar object into a setting string, an authenticated attacker can achieve Arbitrary File Write, leading directly to Remote Code Execution (RCE) on the server. This issue has been patched in versions 6.8.156, 25.0.90, and 26.0.12.
- Product
- groupoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2026Group-Office is an enterprise customer relationship management and groupware tool.CVE-2026-33755 · Other software · Intermesh · reported by GitHubHigh 8.8
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.158, 25.0.92, and 26.0.17, an authenticated SQL Injection vulnerability in the JMAP `Contact/query` endpoint allows any authenticated user with basic addressbook access to extract arbitrary data from the database — including active session tokens of other users. This enables full account takeover of any user, including the System Administrator, without knowing their password. Versions 6.8.158, 25.0.92, and 26.0.17 fix the issue.
- Product
- groupoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2026Group-Office is an enterprise customer relationship management and groupware tool.CVE-2026-30238 · Other software · Intermesh · reported by GitHubMedium 5.1
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is a reflected XSS vulnerability in GroupOffice on the external/index flow. The f parameter (Base64 JSON) is decoded and then injected into an inline JavaScript block without strict escaping, allowing </script><script>...</script> injection and arbitrary JavaScript execution in the victim's browser. This issue has been patched in versions 6.8.155, 25.0.88, and 26.0.10.
- Product
- groupoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2026Group-Office is an enterprise customer relationship management and groupware tool.CVE-2026-30237 · Other software · Intermesh · reported by GitHubLow 2.1
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is a reflected XSS vulnerability in the GroupOffice installer, endpoint install/license.php. The POST field license is rendered without escaping inside a <textarea>, allowing a </textarea><script>...</script> breakout.. This issue has been patched in versions 6.8.155, 25.0.88, and 26.0.10.
- Product
- groupoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026Group-Office is an enterprise customer relationship management and groupware tool.CVE-2026-27947 · Other software · Intermesh · reported by GitHubCritical 9.4
Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to 26.0.9, 25.0.87, and 6.8.154 have an authenticated Remote Code Execution vulnerability in the TNEF attachment processing flow. The vulnerable path extracts attacker-controlled files from `winmail.dat` and then invokes `zip` with a shell wildcard (`*`). Because extracted filenames are attacker-controlled, they can be interpreted as `zip` options and lead to arbitrary command execution. Versions 26.0.9, 25.0.87, and 6.8.154 fix the issue.
- Product
- groupoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026Group-Office is an enterprise customer relationship management and groupware tool.CVE-2026-27832 · Other software · Intermesh · reported by GitHubHigh 7.1
Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to 26.0.8, 25.0.87, and 6.8.153 have a SQL Injection (SQLi) vulnerability, exploitable through the `advancedQueryData` parameter (`comparator` field) on an authenticated endpoint. The endpoint `index.php?r=email/template/emailSelection` processes `advancedQueryData` and forwards the SQL comparator without a strict allowlist into SQL condition building. This enables blind boolean-based exfiltration of the `core_auth_password` table. Versions 26.0.8, 25.0.87, and 6.8.153 fix the issue.
- Product
- groupoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026Group-Office is an enterprise customer relationship management and groupware tool.CVE-2026-25512 · Other software · Intermesh · reported by GitHubCritical 9.4
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.150, 25.0.82, and 26.0.5, there is a remote code execution (RCE) vulnerability in Group-Office. The endpoint email/message/tnefAttachmentFromTempFile directly concatenates the user-controlled parameter tmp_file into an exec() call. By injecting shell metacharacters into tmp_file, an authenticated attacker can execute arbitrary system commands on the server. This issue has been patched in versions 6.8.150, 25.0.82, and 26.0.5.
- Product
- groupoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026Group-Office is an enterprise customer relationship management and groupware tool.CVE-2026-25511 · Other software · Intermesh · reported by GitHubHigh 8.2
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.150, 25.0.82, and 26.0.5, an authenticated user within the System Administrator group can trigger a full SSRF via the WOPI service discovery URL, including access to internal hosts/ports. The SSRF response body can be exfiltrated via the built‑in debug system, turning it into a visible SSRF. This also allows full server-side file read. This issue has been patched in versions 6.8.150, 25.0.82, and 26.0.5.
- Product
- groupoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2026Group-Office is an enterprise customer relationship management and groupware tool.CVE-2026-25134 · Other software · Intermesh · reported by GitHubCritical 9.4
Group-Office is an enterprise customer relationship management and groupware tool. Prior to 6.8.150, 25.0.82, and 26.0.5, the MaintenanceController exposes an action zipLanguage which takes a lang parameter and passes it directly to a system zip command via exec(). This can be combined with uploading a crafted zip file to achieve remote code execution. This vulnerability is fixed in 6.8.150, 25.0.82, and 26.0.5.
- Product
- groupoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026Group-Office is an enterprise customer relationship management and groupware tool.CVE-2026-23887 · Other software · Intermesh · reported by GitHubMedium 5.1
Group-Office is an enterprise customer relationship management and groupware tool. In versions 6.8.148 and below, and 25.0.1 through 25.0.79, the application stores unsanitized filenames in the database, which can lead to Stored Cross-Site Scripting (XSS). Users who interact with these specially crafted file names within the Group-Office application are affected. While the scope is limited to the file-viewing context, it could still be used to interfere with user sessions or perform unintended actions in the browser. This issue is fixed in versions 6.8.149 and 25.0.80.
- Product
- groupoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025An issue in Intermesh BV GroupOffice vulnerable before v.25.0.47 and 6.8.136 allows a remote attacker to execute arbitrary code via the dbToApi() and eval() in CVE-2025-63406 · Other software · Group-office · reported by MITREHigh 8.8
An issue in Intermesh BV GroupOffice vulnerable before v.25.0.47 and 6.8.136 allows a remote attacker to execute arbitrary code via the dbToApi() and eval() in the FunctionField.php
- Product
- Group Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnoahheraud.com
Jun 16, 2025Group-Office is an enterprise customer relationship management and groupware tool.CVE-2025-48993 · Other software · Intermesh · reported by GitHubMedium 5.3
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.123 and 25.0.27, a malicious JavaScript payload can be executed via the Look and Feel formatting fields. Any user can update their Look and Feel Formatting input fields, but the web application does not sanitize their input. This could result in a reflected cross-site scripting (XSS) attack. This issue has been patched in versions 6.8.123 and 25.0.27.
- Product
- groupoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025Group-Office is an enterprise customer relationship management and groupware tool.CVE-2025-48992 · Other software · Intermesh · reported by GitHubMedium 5.2
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.123 and 25.0.27, a stored and blind cross-site scripting (XSS) vulnerability exists in the Name Field of the user profile. A malicious attacker can change their name to a javascript payload, which is executed when a user adds the malicious user to their Synchronization > Address books. This issue has been patched in versions 6.8.123 and 25.0.27.
- Product
- groupoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Group-Office is an enterprise customer relationship management and groupware tool.CVE-2025-48369 · Other software · Intermesh · reported by GitHubMedium 5.3
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.119 and 25.0.20, a persistent Cross-Site Scripting (XSS) vulnerability exists in Groupoffice's tasks comment functionality, allowing attackers to execute arbitrary JavaScript by uploading an file with a crafted filename. When administrators or other users view the task containing this malicious file, the payload executes in their browser context. The application fails to sanitize image filenames before rendering them in the comment. By uploading an image with a crafted filename containing XSS payloads, attackers can steal sensitive information. Versions 6.8.119 and 25.0.20 contain a fix for the issue.
- Product
- groupoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Group-Office is an enterprise customer relationship management and groupware tool.CVE-2025-48368 · Other software · Intermesh · reported by GitHubMedium 5.8
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.119 and 25.0.20, a DOM-based Cross-Site Scripting (XSS) vulnerability exists in the GroupOffice application, allowing attackers to execute arbitrary JavaScript code in the context of the victim's browser. This can lead to session hijacking, defacement, or redirection to malicious sites. The vulnerability can be triggered by injecting a crafted payload into a parameter that is later processed unsafely in the DOM. Versions 6.8.119 and 25.0.20 contain a fix for the issue.
- Product
- groupoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Group-Office is an enterprise customer relationship management and groupware tool.CVE-2025-48366 · Other software · Intermesh · reported by GitHubMedium 6.9
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.119 and 25.0.20, a stored and blind XSS vulnerability exists in the Phone Number field of the user profile within the GroupOffice application. This allows a malicious actor to inject persistent JavaScript payloads, which are triggered in the context of another user when they view the Address Book. Successful exploitation enables actions such as forced redirects, unauthorized fetch requests, or other arbitrary JavaScript execution without user interaction. Versions 6.8.119 and 25.0.20 contain a fix for the issue.
- Product
- groupoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2025Group-Office is an enterprise CRM and groupware tool.CVE-2025-25191 · Other software · Intermesh · reported by GitHubMedium 6.9
Group-Office is an enterprise CRM and groupware tool. This Stored XSS vulnerability exists where user input in the Name field is not properly sanitized before being stored. This vulnerability is fixed in 6.8.100.
- Product
- groupoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2024Group-Office is an enterprise CRM and groupware tool.CVE-2024-22418 · Other software · Intermesh · reported by GitHubMedium 6.5
Group-Office is an enterprise CRM and groupware tool. Affected versions are subject to a vulnerability which is present in the file upload mechanism of Group Office. It allows an attacker to execute arbitrary JavaScript code by embedding it within a file's name. For instance, using a filename such as “><img src=x onerror=prompt('XSS')>.jpg” triggers the vulnerability. When this file is uploaded, the JavaScript code within the filename is executed. This issue has been addressed in version 6.8.29. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- groupoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2023Group-Office is an enterprise CRM and groupware tool.CVE-2023-46730 · Other software · Intermesh · reported by GitHubHigh 7.4
Group-Office is an enterprise CRM and groupware tool. In affected versions there is full Server-Side Request Forgery (SSRF) vulnerability in the /api/upload.php endpoint. The /api/upload.php endpoint does not filter URLs which allows a malicious user to cause the server to make resource requests to untrusted domains. Note that protocols like file:// can also be used to access the server disk. The request result (on success) can then be retrieved using /api/download.php. This issue has been addressed in versions 6.8.15, 6.7.54, and 6.6.177. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- groupoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2014SQL injection vulnerability in modules/calendar/json.php in Group-Office community before 4.0.90 allows remote authenticated users to execute arbitrary SQL commCVE-2012-4240 · Other software · Group-office · reported by MITREMedium 6.5
SQL injection vulnerability in modules/calendar/json.php in Group-Office community before 4.0.90 allows remote authenticated users to execute arbitrary SQL commands via the sort parameter.
- Product
- Groupoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comosvdb.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.