Known vulnerabilities in Group Office

Software: Group Office
Software CPE: cpe:2.3:a:intermesh_bv:group_office:*:*:*:*:*:*:*:*
Total vulnerabilities: 12
Public exploits: 4
Known exploited (KEV): 0
Highest CVSSv4 Score: 8.7

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Group Office Group Office is affected by 12 known vulnerabilities: 6 medium, 6 low Critical High Medium Low

Vulnerabilities (12)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU127583 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-30238
CWE-79 Low
Available
No
6.8.155, 25.0.88, 26.0.10 24.04.2026 SB20260424141
#VU127575 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-33755
CWE-89 Medium
No
No
6.8.158, 25.0.92, 26.0.17 24.04.2026 SB20260424142
#VU127550 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-30237
CWE-79 Low
Available
No
6.8.155, 25.0.88, 26.0.10 24.04.2026 SB20260424141
#VU127527 - Server-Side Request Forgery (SSRF)
CVE-2026-25511
CWE-918 Low
Available
No
6.8.150, 25.0.82, 26.0.5 24.04.2026 SB20260424140
#VU127526 - Unrestricted Upload of File with Dangerous Type
CVE-2026-25134
CWE-434 Medium
No
No
6.8.150, 25.0.82, 26.0.5 24.04.2026 SB20260424140
#VU127513 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2026-25512
CWE-78 Medium
No
No
6.8.150, 25.0.82, 26.0.5 24.04.2026 SB20260424140
#VU127512 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-23887
CWE-79 Low
Available
No
6.8.149, 25.0.80 24.04.2026 SB20260424139
#VU124704 - Deserialization of Untrusted Data
CVE-2026-34838
CWE-502 Medium
No
No
6.8.156, 25.0.90, 26.0.12 31.03.2026 SB2026033190
#VU123350 - Unrestricted Upload of File with Dangerous Type
CVE-2026-27947
CWE-434 Medium
No
No
6.8.154, 25.0.87, 26.0.9 02.03.2026 SB2026030248
#VU123349 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-27832
CWE-89 Medium
No
No
6.8.153, 25.0.87, 26.0.8 02.03.2026 SB2026030247
#VU119385 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-35418
CWE-79 Low
No
No
25.0.69 09.12.2025 SB2025120903
#VU85995 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-23941
CWE-79 Low
No
No
6.6.182, 6.7.64, 6.8.31 01.02.2024 SB2024020120