CVE-2025-48993

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-48993

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48993.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-48993

Aliases

GHSA-xv2x-v374-92gv

Published

2025-06-17T00:43:35.194Z

Modified

2026-04-10T05:28:53.090860Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

Group-Office vulnerable to reflected XSS via Look and Feel Formatting input

Details

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.123 and 25.0.27, a malicious JavaScript payload can be executed via the Look and Feel formatting fields. Any user can update their Look and Feel Formatting input fields, but the web application does not sanitize their input. This could result in a reflected cross-site scripting (XSS) attack. This issue has been patched in versions 6.8.123 and 25.0.27.

Database specific

{
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48993.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/intermesh/groupoffice

Affected ranges

Type: GIT
Repo: https://github.com/intermesh/groupoffice
Events: Introduced

86a5e33c9c9adfc29537c29d42fb0029f456837b

Fixed

d2f83db13718d833cb316a2b933a8ae9349cd7f4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48993.json"