CVE-2025-25191: Group-Office has a Stored XSS Vulnerability via user's name field
Group-Office is an enterprise CRM and groupware tool. This Stored XSS vulnerability exists where user input in the Name field is not properly sanitized before being stored. This vulnerability is fixed in 6.8.100.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Group-Officeto a version that resolves this vulnerability.Fixed in 6.8.100
Event History
Frequently Asked Questions
What is the severity of CVE-2025-25191?
CVE-2025-25191 is classified as a stored cross-site scripting (XSS) vulnerability, which can allow attackers to execute scripts in users' browsers.
How do I fix CVE-2025-25191?
To fix CVE-2025-25191, upgrade to Group-Office version 6.8.100 or later, where the vulnerability has been patched.
What causes CVE-2025-25191?
CVE-2025-25191 is caused by improper sanitization of user input in the Name field, leading to the potential for malicious scripts to be stored.
Who is affected by CVE-2025-25191?
CVE-2025-25191 affects users of Group-Office versions prior to 6.8.100.
What is the impact of CVE-2025-25191 on users?
The impact of CVE-2025-25191 can include session hijacking, data theft, and execution of arbitrary scripts in the victim's browser.