25 matches found
EUVD-2026-120551
Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing authorization vulnerability that allows authenticated users to download form reports via api/download.php without permission checks. Attackers can request the business/forms/report blob with a form ID to export every...
EUVD-2026-120552
Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a stored cross-site scripting vulnerability in the email viewer due to a flawed regex in StringHelper::filterXSS. Remote attackers can send emails containing tags like svg/onload, which MessagePanel.js renders raw, executing...
CVE-2026-125389
Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a stored cross-site scripting vulnerability in the email viewer due to a flawed regex in StringHelper::filterXSS. Remote attackers can send emails containing tags like svg/onload, which MessagePanel.js renders raw, executing...
CVE-2026-125388
Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing authorization vulnerability that allows authenticated users to download form reports via api/download.php without permission checks. Attackers can request the business/forms/report blob with a form ID to export every...
CVE-2026-125389: Intermesh Group-Office: Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a stored cross-site scripting vulnerability in…
Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a stored cross-site scripting vulnerability in the email viewer due to a flawed regex in StringHelper::filterXSS. Remote attackers can send emails containing tags like svg/onload, which MessagePanel.js renders raw, executing...
CVE-2026-125388: Intermesh Group-Office: Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing authorization vulnerability that allows…
Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing authorization vulnerability that allows authenticated users to download form reports via api/download.php without permission checks. Attackers can request the business/forms/report blob with a form ID to export every...
CVE-2026-125389
Intermesh Group-Office versions prior to 6.8.181 , 25.0.116 , and 26.0.58 are vulnerable to a stored cross-site scripting (XSS) vulnerability in the email viewer. The root cause is a flawed regex in StringHelper::filterXSS, which allows remote attackers to bypass security filters. By sending emai...
CVE-2026-125388
Intermesh Group-Office versions prior to 6.8.181, 25.0.116, and 26.0.58 are vulnerable to a missing authorization flaw. This allows authenticated users to bypass permission checks when accessing api/download.php. By requesting the business/forms/report blob with a specific form ID, an attacker ca...
PT-2026-141212
Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a stored cross-site scripting vulnerability in the email viewer due to a flawed regex in StringHelper::filterXSS. Remote attackers can send emails containing tags like svg/onload, which MessagePanel.js renders raw, executing...
PT-2026-141211
Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing authorization vulnerability that allows authenticated users to download form reports via api/download.php without permission checks. Attackers can request the business/forms/report blob with a form ID to export every...
CVE-2018-25438
Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests to /compress.php with '../' sequences in the 'file'...
EUVD-2018-21962
Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests to /compress.php with '../' sequences in the 'file'...
PT-2026-121378
Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests to /compress.php with '../' sequences in the 'file'...
VulnCheck KEV: CVE-2018-25438
Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests to /compress.php with '../' sequences in the 'file'...
CVE-2018-25438: Improper Limitation of a Pathname to a Restricted Directory
Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests to /compress.php with '../' sequences in the 'file'...
Intermesh group-office path traversal vulnerability
Versions of Intermesh Group-Office prior to 3.3.0 and 3.5.5 contain a path traversal vulnerability. This vulnerability stems from a path traversal flaw in compress.php. Remote attackers can exploit it without authentication by manipulating the ../ sequence within the file parameter, thereby readi...
EUVD-2010-3426
Malware in sbrugna...
Intermesh BV Group Office Cross-site Scripting Vulnerability
Intermesh BV Group Office is an enterprise CRM and groupware tool from Intermesh BV open source. A cross-site scripting vulnerability exists in Intermesh BV Group Office versions prior to 6.8.123 and prior to 25.0.27, which stems from insufficient input cleanup and could lead to a reflective...
CVE-2010-3428
SQL injection vulnerability in modules/notes/json.php in Intermesh Group-Office 3.5.9 allows remote attackers to execute arbitrary SQL commands via the categoryid parameter in a category action...
Intermesh BV Group Office CRM security vulnerability
Intermesh BV Group Office CRM is an application from Intermesh BV. Share projects, calendars, files and emails online with colleagues and clients. Easy to use and fully customizable. A security vulnerability exists in Intermesh BV Group Office CRM versions prior to 6.8.119 and 25.0.20, which stem...