Group Office Group Office any version

Group-Office is vulnerable to RCE due to Command Injection via TNEF Attachment Handler

Group-Office Argument Injection in MaintenanceController::actionZipLanguage

An issue in Intermesh BV GroupOffice vulnerable before v.25.0.47 and 6.8.136 allows a remote attacker to execute arbitrary code via the dbToApi() and eval() in the FunctionField.php

Server-Side Request Forgery in groupoffice

Group-Office is vulnerable to SSRF and File Read in WOPI service discovery

Stored Cross-site Scripting Vulnerability via Malicious File Names in GroupOffice

Cross-site scripting vulnerability exists in Group Office prior to v6.6.182, prior to v6.7.64 and prior to v6.8.31, which may allow a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product.

Group-Office has stored XSS vulnerability via unsanitized filenames

Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser.

Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a path traversal vulnerability. If this vulnerability is exploited, information on the server hosting the product may be exposed.