Groupoffice
Vendor:
First CVE: Sep 11, 2014 · Active for 11 years
16
Total CVEs
Bottom 1%
2.7
Avg CVEs / Year
Bottom 1%
6.4
Avg CVSS
Higher Avg CVSS than 33% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Groupoffice over time
Volume of CVEsAvg CVSS Base Score
First CVE
Sep 11, 2014
11 years ago
Most Recent CVE
Feb 4, 2026
174 days ago
CVE Severity & Scoring
Groupoffice16 CVEs
75%
25%
All CVEs353,173 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local0 (0.0%)
Network15 (93.8%)
Unknown1 (6.3%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low15 (93.8%)
High0 (0.0%)
Unknown1 (6.3%)
User Interaction
None7 (43.8%)
Unknown1 (6.3%)
Required8 (50.0%)
Privileges Required
Low10 (62.5%)
High1 (6.3%)
None4 (25.0%)
Unknown1 (6.3%)
Top CVEs
Signals from CVEs in this product scope (16 CVEs).
16 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-25512HIGH Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.150, 25.0.82, and 26.0.5, there is a remote code execution (RCE) vulnerabil | Feb 4, 2026 | 8.8 | 50 | NO | YES |
CVE-2012-4240MEDIUM SQL injection vulnerability in modules/calendar/json.php in Group-Office community before 4.0.90 allows remote authenticated users to execute arbitrary SQL commands via the sort pa | Sep 11, 2014 | 6.5 | 31 | NO | YES |
CVE-2026-25134HIGH Group-Office is an enterprise customer relationship management and groupware tool. Prior to 6.8.150, 25.0.82, and 26.0.5, the MaintenanceController exposes an action zipLanguage wh | Feb 2, 2026 | 8.8 | 30 | NO | NO |
CVE-2025-63406HIGH An issue in Intermesh BV GroupOffice vulnerable before v.25.0.47 and 6.8.136 allows a remote attacker to execute arbitrary code via the dbToApi() and eval() in the FunctionField.ph | Nov 13, 2025 | 8.8 | 27 | NO | NO |
CVE-2023-46730HIGH Group-Office is an enterprise CRM and groupware tool. In affected versions there is full Server-Side Request Forgery (SSRF) vulnerability in the /api/upload.php endpoint. The /api/ | Nov 7, 2023 | 8.8 | 24 | NO | NO |
CVE-2023-25292MEDIUM Reflected Cross Site Scripting (XSS) in Intermesh BV Group-Office version 6.6.145, allows attackers to gain escalated privileges and gain sensitive information via the GO_LANGUAGE | Apr 27, 2023 | 6.1 | 22 | NO | NO |
CVE-2026-23887MEDIUM Group-Office is an enterprise customer relationship management and groupware tool. In versions 6.8.148 and below, and 25.0.1 through 25.0.79, the application stores unsanitized fil | Jan 22, 2026 | 5.4 | 20 | NO | NO |
CVE-2025-53505MEDIUM Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a path traversal vulnerability. If this vulnerability is exploited, information on the | Aug 21, 2025 | 5.3 | 20 | NO | NO |
CVE-2020-35419MEDIUM Cross Site Scripting (XSS) in Group Office CRM 6.4.196 via the SET_LANGUAGE parameter. | Apr 14, 2021 | 6.1 | 20 | NO | NO |
CVE-2025-53504MEDIUM Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary | Aug 21, 2025 | 5.4 | 19 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (16 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
1 CVE
6.2% of CVEs· Bottom 1%
ExploitDB
1 CVE
6.2% of CVEs· 91st percentile
Social Chatter
Signals from CVEs in this product scope (16 CVEs).
Media Mentions
Signals from CVEs in this product scope (16 CVEs).
Top CNAs Publishing CVEs For Groupoffice
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 6.8.99 | 1 | 5.4 | 0.3% | 0 | 0 |
| 6.6.145 | 1 | 6.1 | 0.6% | 0 | 0 |
| 6.4.196 | 3 | 5.6 | 0.9% | 0 | 0 |