What’s Vulnerable › Vulnerabilities

CVE-2025-25191: Group-Office has a Stored XSS Vulnerability via user's name field

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-03-06 · updated 2026-06-17
• Weakness: CWE-79

Description

Group-Office is an enterprise CRM and groupware tool. This Stored XSS vulnerability exists where user input in the Name field is not properly sanitized before being stored. This vulnerability is fixed in 6.8.100.

Affected products

• Intermesh groupoffice: 6.8.99

References

• https://github.com/Intermesh/groupoffice/commit/c5c83e19a5cdf93b0e758726c97597861f1d6eda
• https://github.com/Intermesh/groupoffice/security/advisories/GHSA-j7p3-v652-p3gf

Get alerted when CVE-2025-25191 or the next vulnerability affects your stack