CVE-2025-48366— Intermesh BV Group Office CRM 安全漏洞

GroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized Actions

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.119 and 25.0.20, a stored and blind XSS vulnerability exists in the Phone Number field of the user profile within the GroupOffice application. This allows a malicious actor to inject persistent JavaScript payloads, which are triggered in the context of another user when they view the Address Book. Successful exploitation enables actions such as forced redirects, unauthorized fetch requests, or other arbitrary JavaScript execution without user interaction. Versions 6.8.119 and 25.0.20 contain a fix for the issue.

N/A

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Intermesh BV Group Office CRM 安全漏洞

Intermesh BV Group Office CRM是Intermesh BV公司的一个应用软件。与同事和客户在线共享项目，日历，文件和电子邮件。易于使用且可完全自定义。 Intermesh BV Group Office CRM 6.8.119和25.0.20之前版本存在安全漏洞，该漏洞源于用户资料电话号码字段存在存储型跨站脚本，可能导致任意JavaScript执行。

N/A

N/A