Intermesh vulnerabilities
29 CVEs and advisories name Intermesh as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-63653Group-Office: SSRF via Bookmark/description JMAP action — server makes arbitrary HTTP(S) requests to user-controlled URL and reflects part…
- CVE-2026-63011GroupOffice Vulnerable to RCE in TemplateParser eval() via Contact/labels
- CVE-2026-63010Group-Office: Stored XSS via Manual Reminders
- CVE-2026-125390Group-Office before 6.8.181, 25.0.116, and 26.0.58 Local File Read via processUploadQueue
- CVE-2026-125389Group-Office before 6.8.181, 25.0.116, and 26.0.58 Stored XSS via filterXSS Bypass
- CVE-2026-125388Group-Office before 6.8.181, 25.0.116, and 26.0.58 Missing Authorization in Forms Report Download
- CVE-2018-25438Intermesh Group-Office < 3.5.5 Path Traversal via compress.php
- CVE-2026-45551Group-Office: Authenticated Stored XSS in Administrator Context via Arbitrary Cross-User Setting Write
- CVE-2026-34838Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in `AbstractSettingsCollection`
- CVE-2026-33755Authenticated SQL Injection in Contact/query addressBookIds filter
- CVE-2026-30238Group-Office: Reflected XSS in JavaScript context
- CVE-2026-30237Group-Office: Self XSS in GroupOffice Installer License Page (install/license.php)
- CVE-2026-27947Group-Office Vulnerable to Remote Code Execution (RCE)
- CVE-2026-27832Group-Office Has Authenticated SQL Injection in advancedQueryData.comparator
- CVE-2026-25511Group-Office is vulnerable to SSRF and File Read in WOPI service discovery
- CVE-2026-25512Group-Office is vulnerable to RCE due to Command Injection via TNEF Attachment Handler
- CVE-2026-25134Group-Office Argument Injection in MaintenanceController::actionZipLanguage
- CVE-2026-23887Group-Office has stored XSS vulnerability via unsanitized filenames
- CVE-2025-53505Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a path traversal vulnerability.
- CVE-2025-53504Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a cross-site scripting vulnerability.
- CVE-2025-48993Group-Office vulnerable to reflected XSS via Look and Feel Formatting input
- CVE-2025-48992Group-Office vulnerable to blind XSS
- CVE-2025-48369GroupOffice vulnerable to Stored XSS in Tasks Comment Section
- CVE-2025-48368GroupOffice's DOM-Based XSS in all Date Input Fields Allows Arbitrary JavaScript Execution
- CVE-2025-48366GroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized Actions
- CVE-2025-25191Group-Office has a Stored XSS Vulnerability via user's name field
- CVE-2024-23941Cross-site scripting vulnerability exists in Group Office prior to v6.6.182, prior to v6.7.64 and prior to v6.8.31, which may allow a remote
- CVE-2024-22418Stored Cross-site Scripting Vulnerability via Malicious File Names in GroupOffice
- CVE-2023-46730Server-Side Request Forgery in groupoffice