CVE-2025-48993

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.123 and 25.0.27, a malicious JavaScript payload can be executed via the Look and Feel formatting fields. Any user can update their Look and Feel Formatting input fields, but the web application does not sanitize their input. This could result in a reflected cross-site scripting (XSS) attack. This issue has been patched in versions 6.8.123 and 25.0.27.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 17, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-489946.9SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned CVE-2025-489956.9SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned CVE-2025-489965.3HAX open-apis provides microservice apis for HAX webcomponents repo that are shared infrastructure calls. An unauthenticated information dis CVE-2025-489978.7Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior CVE-2025-489988.8DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, a bypass of the patch for CVE-2025-27 CVE-2025-489998.8DataEase is an open source business intelligence and data visualization tool. A bypass of CVE-2025-46566's patch exists in versions prior to CVE-2025-49009.8A vulnerability classified as critical has been found in Campcodes Sales and Inventory System 1.0. Affected is an unknown function of the fi CVE-2025-490005.7InvenTree is an Open Source Inventory Management System. Prior to version 0.17.13, the skip field in the built-in `label-sheet` plugin lacks CVE-2025-490019.8DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.10, secret verification does not take ef CVE-2025-490029.8DataEase is an open source business intelligence and data visualization tool. Versions prior to version 2.10.10 have a flaw in the patch for CVE-2025-490039.8DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, a threat actor may take advantage of CVE-2025-490047.5Caido is a web security auditing toolkit. Prior to version 0.48.0, due to the lack of protection for DNS rebinding, Caido can be loaded on a