PoC-CVE-2025-63406

CVE-2025-63406 – Security Research Proof-of-Concept PoC This repository contains a research-oriented Proof of Concept PoC related to the security issue CVE-2025-63406 , affecting the GroupOffice platform. The purpose of this project is to study and understand the vulnerability’s behavior , assist...

CVE-2025-63406-PoC

CVE-2025-63406 PoC Installation Install dependencies pip install -r requirements.txt Or use a virtual environment python3 -m venv venv source venv/bin/activate On Windows: venv\Scripts\activate pip install -r requirements.txt Usage python3 CVE-2025-63406.py -u -n -p -c Arguments -u, --url: Base U...

CVE-2026-34838

CVE-2026-34838 PoC https://github.com/Intermesh/groupoffice/security/advisories/GHSA-h22j-frrf-5vxq...

Groupoffice 3.4.21 - Local File Inclusion Detection

Groupoffice 3.4.21 is vulnerable to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """Groupoffice 3.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Groupoffice 3.4.21 - Local File Inclusio...

CVE-2026-45551

Group-Office is an enterprise customer relationship management and groupware tool. Prior to 26.0.25, 25.0.100, and 6.8.165, GroupOffice allows authenticated users to persist arbitrary legacy settings for any userid via index.php?r=core/saveSetting. A separate client-side sink in the email module...

EUVD-2026-33290

Group-Office is an enterprise customer relationship management and groupware tool. Prior to 26.0.25, 25.0.100, and 6.8.165, GroupOffice allows authenticated users to persist arbitrary legacy settings for any userid via index.php?r=core/saveSetting. A separate client-side sink in the email module...

CVE-2026-45551: Improper Neutralization of Input During Web Page Generation

Group-Office is an enterprise customer relationship management and groupware tool. Prior to 26.0.25, 25.0.100, and 6.8.165, GroupOffice allows authenticated users to persist arbitrary legacy settings for any userid via index.php?r=core/saveSetting. A separate client-side sink in the email module...

PT-2026-44827

Name of the Vulnerable Software and Affected Versions GroupOffice versions prior to 26.0.25 GroupOffice versions prior to 25.0.100 GroupOffice versions prior to 6.8.165 Description GroupOffice allows authenticated users to persist arbitrary legacy settings for any user id through the...

GroupOffice SQL injection vulnerability

GroupOffice is an open-source groupware and CRM solution developed by Intermesh. Versions of GroupOffice prior to 6.8.158, 25.0.92, and 26.0.17 contain SQL injection vulnerabilities. These vulnerabilities stem from authenticated SQL injections at the JMAP Contact/query endpoint, which may lead to...

CVE-2026-30237

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is a reflected XSS vulnerability in the GroupOffice installer, endpoint install/license.php. The POST field license is rendered without escaping inside a ,...

CVE-2026-30238

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is a reflected XSS vulnerability in GroupOffice on the external/index flow. The f parameter Base64 JSON is decoded and then injected into an inline JavaScript...

CVE-2026-30237

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is a reflected XSS vulnerability in the GroupOffice installer, endpoint install/license.php. The POST field license is rendered without escaping inside a ,...

CVE-2026-30238

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is a reflected XSS vulnerability in GroupOffice on the external/index flow. The f parameter Base64 JSON is decoded and then injected into an inline JavaScript...

EUVD-2026-10080

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is a reflected XSS vulnerability in GroupOffice on the external/index flow. The f parameter Base64 JSON is decoded and then injected into an inline JavaScript...

CVE-2026-30237 Group-Office: Self XSS in GroupOffice Installer License Page (install/license.php)

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is a reflected XSS vulnerability in the GroupOffice installer, endpoint install/license.php. The POST field license is rendered without escaping inside a ,...

CVE-2026-30237 Group-Office: Self XSS in GroupOffice Installer License Page (install/license.php)

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is a reflected XSS vulnerability in the GroupOffice installer, endpoint install/license.php. The POST field license is rendered without escaping inside a ,...

EUVD-2026-10079

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is a reflected XSS vulnerability in the GroupOffice installer, endpoint install/license.php. The POST field license is rendered without escaping inside a ,...

CVE-2026-30237

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is a reflected XSS vulnerability in the GroupOffice installer, endpoint install/license.php. The POST field license is rendered without escaping inside a ,...

CVE-2026-30237 Group-Office: Self XSS in GroupOffice Installer License Page (install/license.php)

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is a reflected XSS vulnerability in the GroupOffice installer, endpoint install/license.php. The POST field license is rendered without escaping inside a ,...

GroupOffice cross-site scripting vulnerability

GroupOffice is an open-source groupware and CRM developed by Intermesh. Versions of GroupOffice prior to 6.8.155, 25.0.88, and 26.0.10 contained a cross-site scripting vulnerability. This vulnerability stemmed from the f parameter in the external/index process being decoded without proper escapin...