CVE-2025-48992CWE-79CWE-87

Group-Office vulnerable to blind XSS

Medium · published June 16, 2025

CVSS v4.0
5.2
EPSS
0%
Percentile
16.3
In the wild
Unconfirmed
What it is

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.123 and 25.0.27, a stored and blind cross-site scripting (XSS) vulnerability exists in the Name Field of the user profile. A malicious attacker can change their name to a javascript payload, which is executed when a user adds the malicious user to their Synchronization > Address books. This issue has been patched in versions 6.8.123 and 25.0.27.

The record
Technical detail
CVSS v4.0
5.2 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:P
EPSS
0.00256 · 16.3th percentile
Weaknesses
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-87 · Improper Neutralization of Alternate XSS Syntax
Published
2025-06-16T22:17Z
EPSS history
Timeline
  • 16 JUN 22:17Z
    Group-Office vulnerable to blind XSS
    cvelistv5