CVE-2025-25191

Group-Office has a Stored XSS Vulnerability via user's name field

State: Published
Severity: 6.9 Medium
Published: Mar 6, 2025
Updated: Mar 6, 2025
Reserved: Feb 3, 2025

Description

Group-Office is an enterprise CRM and groupware tool. This Stored XSS vulnerability exists where user input in the Name field is not properly sanitized before being stored. This vulnerability is fixed in 6.8.100.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N	GitHub_M

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
groupofficeIntermesh	< 6.8.100Affected

References

https://github.com/Intermesh/groupoffice/security/advisories/GHSA-j7p3-v652-p3gf
https://github.com/Intermesh/groupoffice/commit/c5c83e19a5cdf93b0e758726c97597861f1d6eda

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.