# cve.now: Intermesh

The newest entries naming Intermesh as an affected vendor (up to 200), of 29 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-63653](https://cve.now/CVE-2026-63653.md): Group-Office: SSRF via Bookmark/description JMAP action — server makes arbitrary HTTP(S) requests to user-controlled URL and reflects part… (CVSS 5.0)
- [CVE-2026-63011](https://cve.now/CVE-2026-63011.md): GroupOffice Vulnerable to RCE in TemplateParser eval() via Contact/labels (CVSS 9.4)
- [CVE-2026-63010](https://cve.now/CVE-2026-63010.md): Group-Office: Stored XSS via Manual Reminders (CVSS 8.7)
- [CVE-2026-125390](https://cve.now/CVE-2026-125390.md): Group-Office before 6.8.181, 25.0.116, and 26.0.58 Local File Read via processUploadQueue (CVSS 7.1)
- [CVE-2026-125389](https://cve.now/CVE-2026-125389.md): Group-Office before 6.8.181, 25.0.116, and 26.0.58 Stored XSS via filterXSS Bypass (CVSS 5.3)
- [CVE-2026-125388](https://cve.now/CVE-2026-125388.md): Group-Office before 6.8.181, 25.0.116, and 26.0.58 Missing Authorization in Forms Report Download (CVSS 7.1)
- [CVE-2018-25438](https://cve.now/CVE-2018-25438.md): Intermesh Group-Office \< 3.5.5 Path Traversal via compress.php (CVSS 8.7)
- [CVE-2026-45551](https://cve.now/CVE-2026-45551.md): Group-Office: Authenticated Stored XSS in Administrator Context via Arbitrary Cross-User Setting Write (CVSS 5.1)
- [CVE-2026-34838](https://cve.now/CVE-2026-34838.md): Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in \`AbstractSettingsCollection\` (CVSS 10.0)
- [CVE-2026-33755](https://cve.now/CVE-2026-33755.md): Authenticated SQL Injection in Contact/query addressBookIds filter (CVSS 8.8)
- [CVE-2026-30238](https://cve.now/CVE-2026-30238.md): Group-Office: Reflected XSS in JavaScript context (CVSS 5.1)
- [CVE-2026-30237](https://cve.now/CVE-2026-30237.md): Group-Office: Self XSS in GroupOffice Installer License Page (install/license.php) (CVSS 2.1)
- [CVE-2026-27947](https://cve.now/CVE-2026-27947.md): Group-Office Vulnerable to Remote Code Execution (RCE) (CVSS 9.4)
- [CVE-2026-27832](https://cve.now/CVE-2026-27832.md): Group-Office Has Authenticated SQL Injection in advancedQueryData.comparator (CVSS 7.1)
- [CVE-2026-25511](https://cve.now/CVE-2026-25511.md): Group-Office is vulnerable to SSRF and File Read in WOPI service discovery (CVSS 8.2)
- [CVE-2026-25512](https://cve.now/CVE-2026-25512.md): Group-Office is vulnerable to RCE due to Command Injection via TNEF Attachment Handler (CVSS 9.4)
- [CVE-2026-25134](https://cve.now/CVE-2026-25134.md): Group-Office Argument Injection in MaintenanceController::actionZipLanguage (CVSS 9.4)
- [CVE-2026-23887](https://cve.now/CVE-2026-23887.md): Group-Office has stored XSS vulnerability via unsanitized filenames (CVSS 5.1)
- [CVE-2025-53505](https://cve.now/CVE-2025-53505.md): Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a path traversal vulnerability. (CVSS 4.3)
- [CVE-2025-53504](https://cve.now/CVE-2025-53504.md): Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a cross-site scripting vulnerability. (CVSS 5.4)
- [CVE-2025-48993](https://cve.now/CVE-2025-48993.md): Group-Office vulnerable to reflected XSS via Look and Feel Formatting input (CVSS 5.3)
- [CVE-2025-48992](https://cve.now/CVE-2025-48992.md): Group-Office vulnerable to blind XSS (CVSS 5.2)
- [CVE-2025-48369](https://cve.now/CVE-2025-48369.md): GroupOffice vulnerable to Stored XSS in Tasks Comment Section (CVSS 5.3)
- [CVE-2025-48368](https://cve.now/CVE-2025-48368.md): GroupOffice's DOM-Based XSS in all Date Input Fields Allows Arbitrary JavaScript Execution (CVSS 5.8)
- [CVE-2025-48366](https://cve.now/CVE-2025-48366.md): GroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized Actions (CVSS 6.9)
- [CVE-2025-25191](https://cve.now/CVE-2025-25191.md): Group-Office has a Stored XSS Vulnerability via user's name field (CVSS 6.9)
- [CVE-2024-23941](https://cve.now/CVE-2024-23941.md): Cross-site scripting vulnerability exists in Group Office prior to v6.6.182, prior to v6.7.64 and prior to v6.8.31, which may allow a remote (CVSS 5.4)
- [CVE-2024-22418](https://cve.now/CVE-2024-22418.md): Stored Cross-site Scripting Vulnerability via Malicious File Names in GroupOffice (CVSS 6.5)
- [CVE-2023-46730](https://cve.now/CVE-2023-46730.md): Server-Side Request Forgery in groupoffice (CVSS 7.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/intermesh
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.