{"items":[{"id":"CVE-2018-25438","published":"2026-10-22T10:57:25.404Z","updated":"2026-10-28T18:00:29.939Z","title":"Intermesh Group-Office < 3.5.5 Path Traversal via compress.php","severity":"HIGH","score":8.7,"vendor":"Intermesh","product":"Group-Office","kev":false,"epss":0.00536,"kevAdded":null,"exploit":true},{"id":"CVE-2026-45551","published":"2026-05-29T12:34:22.615Z","updated":"2026-05-29T13:16:31.397Z","title":"Group-Office: Authenticated Stored XSS in Administrator Context via Arbitrary Cross-User Setting Write","severity":"MEDIUM","score":5.1,"vendor":"Intermesh","product":"groupoffice","kev":false,"epss":0.0023,"kevAdded":null,"exploit":true},{"id":"CVE-2026-34838","published":"2026-04-02T19:15:40.591Z","updated":"2026-04-03T12:55:48.631Z","title":"Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in `AbstractSettingsCollection`","severity":"CRITICAL","score":10,"vendor":"Intermesh","product":"groupoffice","kev":false,"epss":0.01042,"kevAdded":null,"exploit":false},{"id":"CVE-2026-33755","published":"2026-03-27T14:08:38.685Z","updated":"2026-03-27T17:23:30.752Z","title":"Authenticated SQL Injection in Contact/query addressBookIds filter","severity":"HIGH","score":8.8,"vendor":"Intermesh","product":"groupoffice","kev":false,"epss":0.00394,"kevAdded":null,"exploit":false},{"id":"CVE-2026-30238","published":"2026-03-06T21:14:03.149Z","updated":"2026-03-09T20:54:28.592Z","title":"Group-Office: Reflected XSS in JavaScript context","severity":"MEDIUM","score":5.1,"vendor":"Intermesh","product":"groupoffice","kev":false,"epss":0.00314,"kevAdded":null,"exploit":true},{"id":"CVE-2026-30237","published":"2026-03-06T21:13:33.925Z","updated":"2026-03-09T20:54:28.748Z","title":"Group-Office: Self XSS in GroupOffice Installer License Page (install/license.php)","severity":"LOW","score":2.1,"vendor":"Intermesh","product":"groupoffice","kev":false,"epss":0.00262,"kevAdded":null,"exploit":true},{"id":"CVE-2026-27947","published":"2026-02-27T19:52:41.592Z","updated":"2026-03-03T20:24:32.730Z","title":"Group-Office Vulnerable to Remote Code Execution (RCE)","severity":"CRITICAL","score":9.4,"vendor":"Intermesh","product":"groupoffice","kev":false,"epss":0.008,"kevAdded":null,"exploit":false},{"id":"CVE-2026-27832","published":"2026-02-27T19:49:57.867Z","updated":"2026-03-02T12:56:47.385Z","title":"Group-Office Has Authenticated SQL Injection in advancedQueryData.comparator","severity":"HIGH","score":7.1,"vendor":"Intermesh","product":"groupoffice","kev":false,"epss":0.00284,"kevAdded":null,"exploit":false},{"id":"CVE-2026-25511","published":"2026-02-04T20:40:04.317Z","updated":"2026-02-05T21:02:22.830Z","title":"Group-Office is vulnerable to SSRF and File Read in WOPI service discovery","severity":"HIGH","score":8.2,"vendor":"Intermesh","product":"groupoffice","kev":false,"epss":0.00439,"kevAdded":null,"exploit":true},{"id":"CVE-2026-25512","published":"2026-02-04T20:39:08.039Z","updated":"2026-02-05T21:03:24.677Z","title":"Group-Office is vulnerable to RCE due to Command Injection via TNEF Attachment Handler","severity":"CRITICAL","score":9.4,"vendor":"Intermesh","product":"groupoffice","kev":false,"epss":0.1986,"kevAdded":null,"exploit":true},{"id":"CVE-2026-25134","published":"2026-02-02T22:40:15.094Z","updated":"2026-02-04T16:53:26.657Z","title":"Group-Office Argument Injection in MaintenanceController::actionZipLanguage","severity":"CRITICAL","score":9.4,"vendor":"Intermesh","product":"groupoffice","kev":false,"epss":0.00886,"kevAdded":null,"exploit":false},{"id":"CVE-2026-23887","published":"2026-01-21T23:39:05.160Z","updated":"2026-01-22T21:52:37.524Z","title":"Group-Office has stored XSS vulnerability via unsanitized filenames","severity":"MEDIUM","score":5.1,"vendor":"Intermesh","product":"groupoffice","kev":false,"epss":0.00274,"kevAdded":null,"exploit":false},{"id":"CVE-2025-48993","published":"2025-06-17T00:43:35.194Z","updated":"2025-06-17T13:45:06.357Z","title":"Group-Office vulnerable to reflected XSS via Look and Feel Formatting input","severity":"MEDIUM","score":5.3,"vendor":"Intermesh","product":"groupoffice","kev":false,"epss":0.00257,"kevAdded":null,"exploit":true},{"id":"CVE-2025-48992","published":"2025-06-16T22:17:28.511Z","updated":"2025-06-17T13:51:00.396Z","title":"Group-Office vulnerable to blind XSS","severity":"MEDIUM","score":5.2,"vendor":"Intermesh","product":"groupoffice","kev":false,"epss":0.00256,"kevAdded":null,"exploit":true},{"id":"CVE-2025-48369","published":"2025-05-22T17:33:06.254Z","updated":"2025-05-22T18:45:32.626Z","title":"GroupOffice vulnerable to Stored XSS in Tasks Comment Section","severity":"MEDIUM","score":5.3,"vendor":"Intermesh","product":"groupoffice","kev":false,"epss":0.00269,"kevAdded":null,"exploit":true},{"id":"CVE-2025-48368","published":"2025-05-22T17:29:57.631Z","updated":"2025-05-22T17:52:08.245Z","title":"GroupOffice's DOM-Based XSS in all Date Input Fields Allows Arbitrary JavaScript Execution","severity":"MEDIUM","score":5.8,"vendor":"Intermesh","product":"groupoffice","kev":false,"epss":0.00274,"kevAdded":null,"exploit":true},{"id":"CVE-2025-48366","published":"2025-05-22T17:28:26.530Z","updated":"2025-05-22T17:55:53.951Z","title":"GroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized Actions","severity":"MEDIUM","score":6.9,"vendor":"Intermesh","product":"groupoffice","kev":false,"epss":0.00289,"kevAdded":null,"exploit":true},{"id":"CVE-2025-25191","published":"2025-03-06T18:41:00.761Z","updated":"2025-03-06T20:35:12.106Z","title":"Group-Office has a Stored XSS Vulnerability via user's name field","severity":"MEDIUM","score":6.9,"vendor":"Intermesh","product":"groupoffice","kev":false,"epss":0.00284,"kevAdded":null,"exploit":true},{"id":"CVE-2024-22418","published":"2024-01-18T20:44:57.229Z","updated":"2025-06-17T21:19:22.320Z","title":"Stored Cross-site Scripting Vulnerability via Malicious File Names in GroupOffice","severity":"MEDIUM","score":6.5,"vendor":"Intermesh","product":"groupoffice","kev":false,"epss":0.00424,"kevAdded":null,"exploit":false},{"id":"CVE-2023-46730","published":"2023-11-07T17:35:36.332Z","updated":"2024-09-04T15:56:13.023Z","title":"Server-Side Request Forgery in groupoffice","severity":"HIGH","score":7.4,"vendor":"Intermesh","product":"groupoffice","kev":false,"epss":0.00595,"kevAdded":null,"exploit":true}]}