# Intermesh groupoffice.

Every CVE that names Intermesh groupoffice among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Group-Office: SSRF via Bookmark/description JMAP action — server makes arbitrary HTTP(S) requests to user-controlled URL and reflects part of the response](https://agentprime.io/advisories/CVE-2026-63653.md)
  `CVE-2026-63653` · CVE record: Intermesh groupoffice · CVSS 5.0 Medium · Not analysed yet · Published 10 Nov 2026 · Tags: Server-side request forgery (SSRF)
- [GroupOffice Vulnerable to RCE in TemplateParser eval() via Contact/labels](https://agentprime.io/advisories/CVE-2026-63011.md)
  `CVE-2026-63011` · CVE record: Intermesh groupoffice · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Nov 2026 · Tags: Code injection, CWE-184
- [Group-Office: Stored XSS via Manual Reminders](https://agentprime.io/advisories/CVE-2026-63010.md)
  `CVE-2026-63010` · CVE record: Intermesh groupoffice · CVSS 8.7 High · Not analysed yet · Published 10 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Group-Office: Authenticated Stored XSS in Administrator Context via Arbitrary Cross-User Setting Write](https://agentprime.io/advisories/CVE-2026-45551.md)
  `CVE-2026-45551` · CVE record: Intermesh groupoffice · CVSS 5.1 Medium · Not analysed yet · Published 29 May 2026 · Tags: Cross-site scripting (XSS), Broken access control
- [Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in \`AbstractSettingsCollection\`](https://agentprime.io/advisories/CVE-2026-34838.md)
  `CVE-2026-34838` · CVE record: Intermesh groupoffice · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Apr 2026 · Tags: Insecure deserialization
- [Authenticated SQL Injection in Contact/query addressBookIds filter](https://agentprime.io/advisories/CVE-2026-33755.md)
  `CVE-2026-33755` · CVE record: Intermesh groupoffice · CVSS 8.8 High · Not analysed yet · Published 27 Mar 2026 · Tags: SQL injection
- [Group-Office: Reflected XSS in JavaScript context](https://agentprime.io/advisories/CVE-2026-30238.md)
  `CVE-2026-30238` · CVE record: Intermesh groupoffice · CVSS 5.1 Medium · Not analysed yet · Published 6 Mar 2026 · Tags: Cross-site scripting (XSS)
- [Group-Office: Self XSS in GroupOffice Installer License Page (install/license.php)](https://agentprime.io/advisories/CVE-2026-30237.md)
  `CVE-2026-30237` · CVE record: Intermesh groupoffice · CVSS 2.1 Low · Not analysed yet · Published 6 Mar 2026 · Tags: Cross-site scripting (XSS)
- [Group-Office Vulnerable to Remote Code Execution (RCE)](https://agentprime.io/advisories/CVE-2026-27947.md)
  `CVE-2026-27947` · CVE record: Intermesh groupoffice · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Feb 2026 · Tags: Command injection, Unrestricted file upload
- [Group-Office Has Authenticated SQL Injection in advancedQueryData.comparator](https://agentprime.io/advisories/CVE-2026-27832.md)
  `CVE-2026-27832` · CVE record: Intermesh groupoffice · CVSS 7.1 High · Not analysed yet · Published 27 Feb 2026 · Tags: SQL injection
- [Group-Office is vulnerable to SSRF and File Read in WOPI service discovery](https://agentprime.io/advisories/CVE-2026-25511.md)
  `CVE-2026-25511` · CVE record: Intermesh groupoffice · CVSS 8.2 High · Not analysed yet · Published 4 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [Group-Office is vulnerable to RCE due to Command Injection via TNEF Attachment Handler](https://agentprime.io/advisories/CVE-2026-25512.md)
  `CVE-2026-25512` · CVE record: Intermesh groupoffice · CVSS 9.4 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.20 · Not analysed yet · Published 4 Feb 2026 · Tags: Command injection
- [Group-Office Argument Injection in MaintenanceController::actionZipLanguage](https://agentprime.io/advisories/CVE-2026-25134.md)
  `CVE-2026-25134` · CVE record: Intermesh groupoffice · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Feb 2026 · Tags: Command injection
- [Group-Office has stored XSS vulnerability via unsanitized filenames](https://agentprime.io/advisories/CVE-2026-23887.md)
  `CVE-2026-23887` · CVE record: Intermesh groupoffice · CVSS 5.1 Medium · Not analysed yet · Published 21 Jan 2026 · Tags: Cross-site scripting (XSS), CWE-20
- [Group-Office vulnerable to reflected XSS via Look and Feel Formatting input](https://agentprime.io/advisories/CVE-2025-48993.md)
  `CVE-2025-48993` · CVE record: Intermesh groupoffice · CVSS 5.3 Medium · Not analysed yet · Published 17 Jun 2025 · Tags: Cross-site scripting (XSS)
- [Group-Office vulnerable to blind XSS](https://agentprime.io/advisories/CVE-2025-48992.md)
  `CVE-2025-48992` · CVE record: Intermesh groupoffice · CVSS 5.2 Medium · Not analysed yet · Published 16 Jun 2025 · Tags: Cross-site scripting (XSS)
- [GroupOffice vulnerable to Stored XSS in Tasks Comment Section](https://agentprime.io/advisories/CVE-2025-48369.md)
  `CVE-2025-48369` · CVE record: Intermesh groupoffice · CVSS 5.3 Medium · Not analysed yet · Published 22 May 2025 · Tags: Cross-site scripting (XSS)
- [GroupOffice's DOM-Based XSS in all Date Input Fields Allows Arbitrary JavaScript Execution](https://agentprime.io/advisories/CVE-2025-48368.md)
  `CVE-2025-48368` · CVE record: Intermesh groupoffice · CVSS 5.8 Medium · Not analysed yet · Published 22 May 2025 · Tags: Cross-site scripting (XSS)
- [GroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized Actions](https://agentprime.io/advisories/CVE-2025-48366.md)
  `CVE-2025-48366` · CVE record: Intermesh groupoffice · CVSS 6.9 Medium · Not analysed yet · Published 22 May 2025 · Tags: Cross-site scripting (XSS)
- [Group-Office has a Stored XSS Vulnerability via user's name field](https://agentprime.io/advisories/CVE-2025-25191.md)
  `CVE-2025-25191` · CVE record: Intermesh groupoffice · CVSS 6.9 Medium · Not analysed yet · Published 6 Mar 2025 · Tags: Cross-site scripting (XSS)
- [Stored Cross-site Scripting Vulnerability via Malicious File Names in GroupOffice](https://agentprime.io/advisories/CVE-2024-22418.md)
  `CVE-2024-22418` · CVE record: Intermesh groupoffice · CVSS 6.5 Medium · Not analysed yet · Published 18 Jan 2024 · Tags: Cross-site scripting (XSS)
- [Server-Side Request Forgery in groupoffice](https://agentprime.io/advisories/CVE-2023-46730.md)
  `CVE-2023-46730` · CVE record: Intermesh groupoffice · CVSS 7.4 High · Not analysed yet · Published 7 Nov 2023 · Tags: Server-side request forgery (SSRF)

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=intermesh-groupoffice>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/intermesh-groupoffice/>. Everything for agents: <https://agentprime.io/llms.txt>.