Group Office is a groupware and collaboration platform that provides email, calendar, document management, and team-communication capabilities, with its vulnerability footprint concentrated around the core Group Office product itself. The observed disclosures reflect the complexity inherent to web-based collaborative applications, though the vendor's exposure remains modestly represented in the broader vulnerability landscape. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Group Office over time
Signals from CVEs in this vendor scope (17 CVEs).
17 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-25512HIGH Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.150, 25.0.82, and 26.0.5, there is a remote code execution (RCE) vulnerabil | Feb 4, 2026 | 8.8 | 50 | NO | YES |
CVE-2012-4240MEDIUM SQL injection vulnerability in modules/calendar/json.php in Group-Office community before 4.0.90 allows remote authenticated users to execute arbitrary SQL commands via the sort pa | Sep 11, 2014 | 6.5 | 31 | NO | YES |
CVE-2026-25134HIGH Group-Office is an enterprise customer relationship management and groupware tool. Prior to 6.8.150, 25.0.82, and 26.0.5, the MaintenanceController exposes an action zipLanguage wh | Feb 2, 2026 | 8.8 | 30 | NO | NO |
CVE-2025-63406HIGH An issue in Intermesh BV GroupOffice vulnerable before v.25.0.47 and 6.8.136 allows a remote attacker to execute arbitrary code via the dbToApi() and eval() in the FunctionField.ph | Nov 13, 2025 | 8.8 | 27 | NO | NO |
CVE-2023-46730HIGH Group-Office is an enterprise CRM and groupware tool. In affected versions there is full Server-Side Request Forgery (SSRF) vulnerability in the /api/upload.php endpoint. The /api/ | Nov 7, 2023 | 8.8 | 24 | NO | NO |
CVE-2023-25292MEDIUM Reflected Cross Site Scripting (XSS) in Intermesh BV Group-Office version 6.6.145, allows attackers to gain escalated privileges and gain sensitive information via the GO_LANGUAGE | Apr 27, 2023 | 6.1 | 22 | NO | NO |
CVE-2026-23887MEDIUM Group-Office is an enterprise customer relationship management and groupware tool. In versions 6.8.148 and below, and 25.0.1 through 25.0.79, the application stores unsanitized fil | Jan 22, 2026 | 5.4 | 20 | NO | NO |
CVE-2025-53505MEDIUM Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a path traversal vulnerability. If this vulnerability is exploited, information on the | Aug 21, 2025 | 5.3 | 20 | NO | NO |
CVE-2020-35419MEDIUM Cross Site Scripting (XSS) in Group Office CRM 6.4.196 via the SET_LANGUAGE parameter. | Apr 14, 2021 | 6.1 | 20 | NO | NO |
CVE-2025-53504MEDIUM Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary | Aug 21, 2025 | 5.4 | 19 | NO | NO |
Signals from CVEs in this vendor scope (17 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Group Office.
Media articles that mention a CVE ID that affects a product developed by Group Office — matched by CVE ID, not by vendor name.