CVE-2025-63406

An issue in Intermesh BV GroupOffice vulnerable before v.25.0.47 and 6.8.136 allows a remote attacker to execute arbitrary code via the dbToApi() and eval() in the FunctionField.php

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.74% chance of exploitation in the next 30 days, 52th percentile

Published

2025-11-13

Updated

2025-11-19

Proof-of-concept exploits (3)

• WinDyAlphA/CVE-2025-63406-PoC
• Nxvh1337/CVE-2025-63406-PoC
• richard-natan/PoC-CVE-2025-63406

References

• CVE Record
• NVD entry

Related

• CVE-2015-9235
• CVE-2025-15602
• CVE-2025-66224
• CVE-2025-6340
• CVE-2025-63408
• CVE-2025-6339