What is CVE-2025-25191?

CVE-2025-25191 is a medium-severity vulnerability in Group-office Group_office, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2025-03-06.

How severe is CVE-2025-25191?

Medium severity. CVSS v3 base score is 5.4 out of 10.

XSS in Group-office Group_office

CVE-2025-25191

Group-Office is an enterprise CRM and groupware tool. This Stored XSS vulnerability exists where user input in the Name field is not properly sanitized before being stored. This vulnerability is fixed in 6.8.100.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.003 (17.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

Affected products

Group-office Group_office — versions 6.8.99
Intermesh Groupoffice — versions < 6.8.100

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2025-25191?: CVE-2025-25191 is a medium-severity vulnerability in Group-office Group_office, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2025-03-06.
How severe is CVE-2025-25191?: Medium severity. CVSS v3 base score is 5.4 out of 10.