Most recent entries from all

EUVD-2026-263440

2026-10-06T18:19:45.440911+00:00

EUVD-2026-263440

fkie_cve-2025-57883

2026-10-06T18:19:45.440953+00:00

Reflected cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2. If a user accesses a crafted page or URL, an arbitrary script may be executed on the web browser of the user.

GHSA-rmh5-g93f-xrhx

2026-10-06T18:19:45.440988+00:00

jvndb-2025-000113

2026-10-06T18:19:45.441005+00:00

GroupSession provided by Japan Total System Co.,Ltd. contains multiple vulnerabilities listed below.

Stored cross-site scripting (CWE-79) - CVE-2025-53523
Stored cross-site scripting (CWE-79) - CVE-2025-54407
Reflected cross-site scripting (CWE-79) - CVE-2025-57883
Cross-site request forgery (CWE-352) - CVE-2025-58576
Authorization bypass through user-controlled key (CWE-639) - CVE-2025-61950
Missing origin validation in webSockets (CWE-1385) - CVE-2025-61987
SQL injection (CWE-89) - CVE-2025-62192
Initialization of a resource with an insecure default (CWE-1188) - CVE-2025-64781
This can be exploited only when External page display restriction is set as "Do not limit", as in the initial configurationReflected cross-site scripting (CWE-79) - CVE-2025-65120
Stored cross-site scripting (CWE-79) - CVE-2025-66284

The following people reported these vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2025-53523 Reporter: Shogo Iyota of GMO Cybersecurity by Ierae Gaku Mochizuki, Tsutomu Aramaki, and Taiga Shirakura of Mitsui Bussan Secure Directions, Inc. Natsumi Furukawa CVE-2025-54407 Reporter: Toshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc. CVE-2025-57883 Reporter: Tsuyuki Takumi of Mitsui Bussan Secure Directions, Inc. Ryo Sato CVE-2025-58576 Rep…