SQL Injection vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2. If exploited, information stored in the database may be obtained or altered by an authenticated user.

SQL Injection vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2. If exploited, information stored in the database may be obtained or altered by an authenticated user.

GroupSession provided by Japan Total System Co.,Ltd. contains multiple vulnerabilities listed below. <ul><li>Stored cross-site scripting (CWE-79) - CVE-2025-53523</li> <li>Stored cross-site scripting (CWE-79) - CVE-2025-54407</li> <li>Reflected cross-site scripting (CWE-79) - CVE-2025-57883</li> <li>Cross-site request forgery (CWE-352) - CVE-2025-58576</li> <li>Authorization bypass through user-controlled key (CWE-639) - CVE-2025-61950</li> <li>Missing origin validation in webSockets (CWE-1385) - CVE-2025-61987</li><li>SQL injection (CWE-89) - CVE-2025-62192</li> <li>Initialization of a resource with an insecure default (CWE-1188) - CVE-2025-64781</li> <li>This can be exploited only when External page display restriction is set as "Do not limit", as in the initial configurationReflected cross-site scripting (CWE-79) - CVE-2025-65120</li> <li>Stored cross-site scripting (CWE-79) - CVE-2025-66284</li></ul> The following people reported these vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2025-53523 Reporter: Shogo Iyota of GMO Cybersecurity by Ierae Gaku Mochizuki, Tsutomu Aramaki, and Taiga Shirakura of Mitsui Bussan Secure Directions, Inc. Natsumi Furukawa CVE-2025-54407 Reporter: Toshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc. CVE-2025-57883 Reporter: Tsuyuki Takumi of Mitsui Bussan Secure Directions, Inc. Ryo Sato CVE-2025-58576 Rep…