CVE-2025-25191CWE-79

Group-Office has a Stored XSS Vulnerability via user's name field

Medium · published March 6, 2025

CVSS v4.0
6.9
EPSS
0%
Percentile
19.8
In the wild
Unconfirmed
What it is

Group-Office is an enterprise CRM and groupware tool. This Stored XSS vulnerability exists where user input in the Name field is not properly sanitized before being stored. This vulnerability is fixed in 6.8.100.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00284 · 19.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-03-06T18:41Z
EPSS history
Timeline
  • 06 MAR 18:41Z
    Group-Office has a Stored XSS Vulnerability via user's name field
    cvelistv5