XSS in Intermesh Groupoffice

CVE-2025-48992

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.123 and 25.0.27, a stored and blind cross-site scripting (XSS) vulnerability exists in the Name Field of the user profile. A malicious…

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.002 (37.4th percentile) — read the EPSS interpretation.

Affected products

Intermesh Groupoffice — versions < 6.8.123, < 25.0.27

Weakness classification (CWE)

References

https://github.com/Intermesh/groupoffice/security/advisories/GHSA-j35g-q5mc-jwgp (x_refsource_CONFIRM)
https://github.com/Intermesh/groupoffice/commit/2e3695db9cdef1da7a9d754ff4d98f49f6924e2d (x_refsource_MISC)