Intermesh Groupoffice vulnerabilities

• intermesh groupoffice Group-Office: Authenticated Stored XSS in Administrator Context via Arbitrary Cross-User Setting Write CVE-2026-45551 5.1 MediumMay 29, 2026
• intermesh group-office, groupoffice +1 more Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in `AbstractSettingsCollection` CVE-2026-34838 Public exploit 10.0 CriticalApril 2, 2026
• intermesh group-office, groupoffice +1 more Authenticated SQL Injection in Contact/query addressBookIds filter CVE-2026-33755 8.8 HighMarch 27, 2026
• intermesh group-office, groupoffice +1 more Group-Office: Reflected XSS in JavaScript context CVE-2026-30238 5.1 MediumMarch 6, 2026
• intermesh group-office, groupoffice +1 more Group-Office: Self XSS in GroupOffice Installer License Page (install/license.php) CVE-2026-30237 2.1 LowMarch 6, 2026
• intermesh group-office, groupoffice +1 more Group-Office Vulnerable to Remote Code Execution (RCE) CVE-2026-27947 9.4 CriticalFebruary 27, 2026
• intermesh group-office, groupoffice +1 more Group-Office Has Authenticated SQL Injection in advancedQueryData.comparator CVE-2026-27832 7.1 HighFebruary 27, 2026
• group-office group office, intermesh groupoffice +1 more Group-Office is vulnerable to SSRF and File Read in WOPI service discovery CVE-2026-25511 8.2 HighFebruary 4, 2026
• group-office group office, intermesh groupoffice +1 more Group-Office is vulnerable to RCE due to Command Injection via TNEF Attachment Handler CVE-2026-25512 Public exploit EPSS 19.9% 9.4 CriticalFebruary 4, 2026
• group-office group office, intermesh groupoffice +1 more Group-Office Argument Injection in MaintenanceController::actionZipLanguage CVE-2026-25134 9.4 CriticalFebruary 2, 2026
• group-office group office, intermesh groupoffice +1 more Group-Office has stored XSS vulnerability via unsanitized filenames CVE-2026-23887 5.1 MediumJanuary 21, 2026
• intermesh group-office, groupoffice +1 more Group-Office vulnerable to reflected XSS via Look and Feel Formatting input CVE-2025-48993 5.3 MediumJune 17, 2025
• intermesh group-office, groupoffice +1 more Group-Office vulnerable to blind XSS CVE-2025-48992 5.2 MediumJune 16, 2025
• intermesh group-office, groupoffice +1 more GroupOffice vulnerable to Stored XSS in Tasks Comment Section CVE-2025-48369 5.3 MediumMay 22, 2025
• intermesh group-office, groupoffice +1 more GroupOffice's DOM-Based XSS in all Date Input Fields Allows Arbitrary JavaScript Execution CVE-2025-48368 5.8 MediumMay 22, 2025
• intermesh group-office, groupoffice +1 more GroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized Actions CVE-2025-48366 6.9 MediumMay 22, 2025
• group-office group office, intermesh groupoffice +1 more Group-Office has a Stored XSS Vulnerability via user's name field CVE-2025-25191 6.9 MediumMarch 6, 2025
• group-office group office, intermesh groupoffice +1 more Stored Cross-site Scripting Vulnerability via Malicious File Names in GroupOffice CVE-2024-22418 6.5 MediumJanuary 18, 2024
• intermesh group-office, groupoffice, group-office group office +2 more Server-Side Request Forgery in groupoffice CVE-2023-46730 7.4 HighNovember 7, 2023