Intermesh groupoffice vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20241
3. 20256
4. 202611

Newest CVEs

• CVE-2026-45551

  Group-Office: Authenticated Stored XSS in Administrator Context via Arbitrary Cross-User Setting Write

  Intermesh · groupoffice

  Medium5.1
• CVE-2026-34838

  Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in `AbstractSettingsCollection`

  Intermesh · groupoffice

  Critical10.0
• CVE-2026-33755

  Authenticated SQL Injection in Contact/query addressBookIds filter

  Intermesh · groupoffice

  High8.8
• CVE-2026-30238

  Group-Office: Reflected XSS in JavaScript context

  Intermesh · groupoffice

  Medium5.1
• CVE-2026-30237

  Group-Office: Self XSS in GroupOffice Installer License Page (install/license.php)

  Intermesh · groupoffice

  Low2.1
• CVE-2026-27947

  Group-Office Vulnerable to Remote Code Execution (RCE)

  Intermesh · groupoffice

  Critical9.4
• CVE-2026-27832

  Group-Office Has Authenticated SQL Injection in advancedQueryData.comparator

  Intermesh · groupoffice

  High7.1
• CVE-2026-25511

  Group-Office is vulnerable to SSRF and File Read in WOPI service discovery

  Intermesh · groupoffice

  High8.2
• CVE-2026-25512

  Group-Office is vulnerable to RCE due to Command Injection via TNEF Attachment Handler

  Intermesh · groupoffice

  Critical9.4
• CVE-2026-25134

  Group-Office Argument Injection in MaintenanceController::actionZipLanguage

  Intermesh · groupoffice

  Critical9.4