CVE Browser

Group-Office: Authenticated Stored XSS in Administrator Context via Arbitrary Cross-User Setting Write

Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in `AbstractSettingsCollection`

Authenticated SQL Injection in Contact/query addressBookIds filter

Group-Office: Reflected XSS in JavaScript context

Group-Office: Self XSS in GroupOffice Installer License Page (install/license.php)

Group-Office Vulnerable to Remote Code Execution (RCE)

Group-Office Has Authenticated SQL Injection in advancedQueryData.comparator

Group-Office is vulnerable to SSRF and File Read in WOPI service discovery

Group-Office is vulnerable to RCE due to Command Injection via TNEF Attachment Handler

Group-Office Argument Injection in MaintenanceController::actionZipLanguage

Group-Office has stored XSS vulnerability via unsanitized filenames

Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a path traversal vulnerability. If this vulnerability is exploited…

Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a cross-site scripting vulnerability. If this vulnerability is exp…

Group-Office vulnerable to reflected XSS via Look and Feel Formatting input

Group-Office vulnerable to blind XSS

GroupOffice vulnerable to Stored XSS in Tasks Comment Section

GroupOffice's DOM-Based XSS in all Date Input Fields Allows Arbitrary JavaScript Execution

GroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized Actions

Group-Office has a Stored XSS Vulnerability via user's name field

Cross-site scripting vulnerability exists in Group Office prior to v6.6.182, prior to v6.7.64 and prior to v6.8.31, which may allow a remote authenticated atta…

Stored Cross-site Scripting Vulnerability via Malicious File Names in GroupOffice

Server-Side Request Forgery in groupoffice

SQL injection vulnerability in modules/notes/json.php in Intermesh Group-Office 3.5.9 allows remote attackers to execute arbitrary SQL commands via the categor…