PT-2026-23758

Name of the Vulnerable Software and Affected Versions Group-Office versions prior to 6.8.155 Group-Office versions prior to 25.0.88 Group-Office versions prior to 26.0.10 Description Group-Office is a customer relationship management and groupware tool. A reflected cross-site scripting XSS issue...

groupoffice SQL注入漏洞

GroupOffice is an open-source groupware and CRM solution developed by Intermesh. Versions of GroupOffice prior to 26.0.8, 25.0.87, and 6.8.153 contain SQL injection vulnerabilities. These vulnerabilities stem from improper handling of the advancedQueryData parameter, which may lead to SQL injecti...

CVE-2026-25512

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.150, 25.0.82, and 26.0.5, there is a remote code execution RCE vulnerability in Group-Office. The endpoint email/message/tnefAttachmentFromTempFile directly concatenates the user-controlled...

Exploit for CVE-2025-63406

CVE-2025-63406 – Security Research Proof-of-Concept PoC Thi...

CVE-2025-63406

An issue in Intermesh BV GroupOffice vulnerable before v.25.0.47 and 6.8.136 allows a remote attacker to execute arbitrary code via the dbToApi and eval in the FunctionField.php...

EUVD-2025-175371

An issue in Intermesh BV GroupOffice vulnerable before v.25.0.47 and 6.8.136 allows a remote attacker to execute arbitrary code via the dbToApi and eval in the FunctionField.php...

CVE-2025-63406

An issue in Intermesh BV GroupOffice vulnerable before v.25.0.47 and 6.8.136 allows a remote attacker to execute arbitrary code via the dbToApi and eval in the FunctionField.php...

groupoffice 安全漏洞

groupoffice is an Intermesh open source groupware and CRM for group offices. A security vulnerability exists in groupoffice versions prior to 25.0.47 and prior to 6.8.136, which stems from a flaw in the dbToApi and eval functions in FunctionField.php that could lead to the execution of arbitrary...

CVE-2025-63406

An issue in Intermesh BV GroupOffice vulnerable before v.25.0.47 and 6.8.136 allows a remote attacker to execute arbitrary code via the dbToApi and eval in the FunctionField.php...

CVE-2025-63406

An issue in Intermesh BV GroupOffice vulnerable before v.25.0.47 and 6.8.136 allows a remote attacker to execute arbitrary code via the dbToApi and eval in the FunctionField.php...

CVE-2025-63406

CVE-2025-63406 affects Intermesh BV GroupOffice prior to 25.0.47 and 6.8.136. The root cause is improper handling in FunctionField.php (dbToApi() and eval()) that can enable remote code execution. A PoC/PoC-like content exists in linked GitHub repositories; remediation is to upgrade GroupOffice t...

PT-2025-46893

Name of the Vulnerable Software and Affected Versions GroupOffice versions prior to 25.0.47 GroupOffice versions prior to 6.8.136 Description A flaw exists that allows a remote attacker to execute arbitrary code. This is possible through the dbToApi and eval functions within the FunctionField.php...

CVE-2025-63406

An issue in Intermesh BV GroupOffice vulnerable before v.25.0.47 and 6.8.136 allows a remote attacker to execute arbitrary code via the dbToApi and eval in the FunctionField.php...

EUVD-2025-16174

Malicious code in bioql PyPI...

EUVD-2025-16176

Malicious code in bioql PyPI...

groupoffice 安全漏洞

groupoffice is an Intermesh open source groupware and CRM for group offices. A security vulnerability exists in groupoffice versions prior to 6.8.123 and 25.0.27, which stems from stored and blind cross-site scripting and could lead to the execution of arbitrary code...

CVE-2025-48368

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.119 and 25.0.20, a DOM-based Cross-Site Scripting XSS vulnerability exists in the GroupOffice application, allowing attackers to execute arbitrary JavaScript code in the context of the victim'...

CVE-2025-48366

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.119 and 25.0.20, a stored and blind XSS vulnerability exists in the Phone Number field of the user profile within the GroupOffice application. This allows a malicious actor to inject persisten...

CVE-2025-48369 GroupOffice vulnerable to Stored XSS in Tasks Comment Section

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.119 and 25.0.20, a persistent Cross-Site Scripting XSS vulnerability exists in Groupoffice's tasks comment functionality, allowing attackers to execute arbitrary JavaScript by uploading an fil...

CVE-2025-48369

CVE-2025-48369 affects Group-Office (enterprise CRM/groupware). A persistent XSS flaw exists in the tasks comment feature where uploading a file with a crafted filename allows arbitrary JavaScript to run when users view the task comment. The issue stems from failing to sanitize image filenames be...