CVE-2026-30237

Group-Office (enterprise CRM/groupware) is affected by a reflected XSS in the installer at install/license.php. Versions prior to 6.8.155, 25.0.88, and 26.0.10 render the POST parameter license inside a textarea without escaping, enabling a breakout sequence such as . This could allow arbitrary s...