https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-25512.htmlhttps://patchthecve.com/cve/CVE-2026-25512.htmlWed, 17 Jun 2026 10:24:46 +0000HIGH 8.8: Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.150, 25.0.82, and 26.0.5, there is a remote code execution (RCE) vulnerability in Group-Office. The endpoint email/message/tnefAttachmentFromTempFile directly concatenates the user-controlled parhttps://patchthecve.com/cve/CVE-2026-25511.htmlhttps://patchthecve.com/cve/CVE-2026-25511.htmlWed, 17 Jun 2026 10:24:46 +0000MEDIUM 4.9: Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.150, 25.0.82, and 26.0.5, an authenticated user within the System Administrator group can trigger a full SSRF via the WOPI service discovery URL, including access to internal hosts/ports. The SSRhttps://patchthecve.com/cve/CVE-2026-25134.htmlhttps://patchthecve.com/cve/CVE-2026-25134.htmlWed, 17 Jun 2026 10:24:09 +0000HIGH 8.8: Group-Office is an enterprise customer relationship management and groupware tool. Prior to 6.8.150, 25.0.82, and 26.0.5, the MaintenanceController exposes an action zipLanguage which takes a lang parameter and passes it directly to a system zip command via exec(). This can be combined with uploadinhttps://patchthecve.com/cve/CVE-2026-23887.htmlhttps://patchthecve.com/cve/CVE-2026-23887.htmlWed, 17 Jun 2026 10:22:15 +0000MEDIUM 5.4: Group-Office is an enterprise customer relationship management and groupware tool. In versions 6.8.148 and below, and 25.0.1 through 25.0.79, the application stores unsanitized filenames in the database, which can lead to Stored Cross-Site Scripting (XSS). Users who interact with these specially crahttps://patchthecve.com/cve/CVE-2025-63406.htmlhttps://patchthecve.com/cve/CVE-2025-63406.htmlWed, 17 Jun 2026 09:53:05 +0000HIGH 8.8: An issue in Intermesh BV GroupOffice vulnerable before v.25.0.47 and 6.8.136 allows a remote attacker to execute arbitrary code via the dbToApi() and eval() in the FunctionField.phphttps://patchthecve.com/cve/CVE-2025-53505.htmlhttps://patchthecve.com/cve/CVE-2025-53505.htmlWed, 17 Jun 2026 09:38:20 +0000MEDIUM 5.3: Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a path traversal vulnerability. If this vulnerability is exploited, information on the server hosting the product may be exposed.https://patchthecve.com/cve/CVE-2025-53504.htmlhttps://patchthecve.com/cve/CVE-2025-53504.htmlWed, 17 Jun 2026 09:38:20 +0000MEDIUM 5.4: Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser.https://patchthecve.com/cve/CVE-2024-23941.htmlhttps://patchthecve.com/cve/CVE-2024-23941.htmlWed, 17 Jun 2026 07:13:55 +0000MEDIUM 5.4: Cross-site scripting vulnerability exists in Group Office prior to v6.6.182, prior to v6.7.64 and prior to v6.8.31, which may allow a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product.https://patchthecve.com/cve/CVE-2024-22418.htmlhttps://patchthecve.com/cve/CVE-2024-22418.htmlWed, 17 Jun 2026 07:11:22 +0000MEDIUM 6.5: Group-Office is an enterprise CRM and groupware tool. Affected versions are subject to a vulnerability which is present in the file upload mechanism of Group Office. It allows an attacker to execute arbitrary JavaScript code by embedding it within a file's name. For instance, using a filename such a