Product by Intermesh
Groupoffice
19 known vulnerabilities in Groupoffice (Intermesh), 0 of them actively exploited (CISA KEV).
Key figures
19
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
4
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-25512 | Group-Office is vulnerable to RCE due to Command Injection via TNEF Attachment Handler | 8.8 | |
| Critical | CVE-2026-34838 | Intermesh Groupoffice: Deserialization of Untrusted Data | 10.0 | |
| Critical | CVE-2026-25134 | Group-Office Argument Injection in MaintenanceController::actionZipLanguage | 8.8 | |
| Critical | CVE-2026-27947 | Group-Office Vulnerable to Remote Code Execution (RCE) | 8.8 | |
| High | CVE-2026-33755 | Authenticated SQL Injection in Contact/query addressBookIds filter | 8.8 | |
| High | CVE-2026-25511 | Group-Office is vulnerable to SSRF and File Read in WOPI service discovery | 4.9 | |
| High | CVE-2026-27832 | Group-Office Has Authenticated SQL Injection in advancedQueryData.comparator | 8.8 | |
| High | CVE-2023-46730 | Server-Side Request Forgery in groupoffice | 7.4 | |
| Medium | CVE-2026-30238 | Group-Office: Reflected XSS in JavaScript context | 6.1 | |
| Medium | CVE-2024-22418 | Stored Cross-site Scripting Vulnerability via Malicious File Names in GroupOffice | 6.5 | |
| Medium | CVE-2026-30237 | Group-Office: Self XSS in GroupOffice Installer License Page (install/license.php) | 6.1 | |
| Medium | CVE-2025-48366 | Intermesh Groupoffice: Improper Neutralization of Alternate XSS Syntax | 5.4 | |
| Medium | CVE-2025-25191 | Group-Office has a Stored XSS Vulnerability via user's name field | 5.4 | |
| Medium | CVE-2026-45551 | Intermesh Groupoffice: Cross-site Scripting | — | |
| Medium | CVE-2026-23887 | Group-Office has stored XSS vulnerability via unsanitized filenames | 5.4 | |
| Medium | CVE-2025-48993 | Group-Office vulnerable to reflected XSS via Look and Feel Formatting input | 6.1 | |
| Medium | CVE-2025-48368 | GroupOffice's DOM-Based XSS in all Date Input Fields Allows Arbitrary JavaScript Execution | 5.4 | |
| Medium | CVE-2025-48369 | GroupOffice vulnerable to Stored XSS in Tasks Comment Section | 5.4 | |
| Medium | CVE-2025-48992 | Group-Office vulnerable to blind XSS | 4.8 |