CVE-2025-25191

6.9 mediumEPSS 0.3%

Medium (6.9) in group-office group office. EPSS 0.3% chance of exploitation in the next 30 days.

Group-Office is an enterprise CRM and groupware tool. This Stored XSS vulnerability exists where user input in the Name field is not properly sanitized before being stored. This vulnerability is fixed in 6.8.100.

Severity

CVSS 4.0

6.9 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 20% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2025-03-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

group-office:group_office

References

https://github.com/Intermesh/groupoffice/commit/c5c83e19a5cdf93b0e758726c97597861f1d6eda
https://github.com/Intermesh/groupoffice/security/advisories/GHSA-j7p3-v652-p3gf

Check your stack JSON