CVE-2025-48993CWE-79

Group-Office vulnerable to reflected XSS via Look and Feel Formatting input

Medium · published June 17, 2025

CVSS v4.0
5.3
EPSS
0%
Percentile
16.4
In the wild
Unconfirmed
What it is

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.123 and 25.0.27, a malicious JavaScript payload can be executed via the Look and Feel formatting fields. Any user can update their Look and Feel Formatting input fields, but the web application does not sanitize their input. This could result in a reflected cross-site scripting (XSS) attack. This issue has been patched in versions 6.8.123 and 25.0.27.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00257 · 16.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-06-17T00:43Z
EPSS history
Timeline
  • 17 JUN 00:43Z
    Group-Office vulnerable to reflected XSS via Look and Feel Formatting input
    cvelistv5