Intermesh Group-Office vulnerabilities

13 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 12 published in the last 12 months.

Latest Intermesh Group-Office vulnerabilities

CVE-2018-25438 — Intermesh Group-Office < 3.5.5 Path Traversal via compress.php (CVSS 7.5)
CVE-2026-34838 — Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in `AbstractSettingsCollection` (CVSS 9.9)
CVE-2026-33755 — Authenticated SQL Injection in Contact/query addressBookIds filter (CVSS 8.8)
CVE-2026-30238 — Group-Office: Reflected XSS in JavaScript context (CVSS 6.1)
CVE-2026-30237 — Group-Office: Self XSS in GroupOffice Installer License Page (install/license.php) (CVSS 6.1)
CVE-2026-27947 — Group-Office Vulnerable to Remote Code Execution (RCE) (CVSS 8.8)
CVE-2026-27832 — Group-Office Has Authenticated SQL Injection in advancedQueryData.comparator (CVSS 8.8)
CVE-2025-48993 — Group-Office vulnerable to reflected XSS via Look and Feel Formatting input (CVSS 6.1)
CVE-2025-48992 — Group-Office vulnerable to blind XSS (CVSS 4.8)
CVE-2025-48369 — GroupOffice vulnerable to Stored XSS in Tasks Comment Section (CVSS 5.4)
CVE-2025-48368 — GroupOffice's DOM-Based XSS in all Date Input Fields Allows Arbitrary JavaScript Execution (CVSS 5.4)
CVE-2025-48366 — GroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized Actions (CVSS 5.4)
CVE-2010-3428 — (CVSS 7.5)