Most recent entries from all

EUVD-2026-263473

2026-10-06T23:21:05.610871+00:00

EUVD-2026-263473

fkie_cve-2025-64781

2026-10-06T23:21:05.610927+00:00

In GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION prior to ver5.7.1, "External page display restriction" is set to "Do not limit" in the initial configuration. With this configuration, the user may be redirected to an arbitrary website when accessing a specially crafted URL.

GHSA-778m-x6m8-v6h8

2026-10-06T23:21:05.610994+00:00

jvndb-2025-000113

2026-10-06T23:21:05.611025+00:00

GroupSession provided by Japan Total System Co.,Ltd. contains multiple vulnerabilities listed below.

Stored cross-site scripting (CWE-79) - CVE-2025-53523
Stored cross-site scripting (CWE-79) - CVE-2025-54407
Reflected cross-site scripting (CWE-79) - CVE-2025-57883
Cross-site request forgery (CWE-352) - CVE-2025-58576
Authorization bypass through user-controlled key (CWE-639) - CVE-2025-61950
Missing origin validation in webSockets (CWE-1385) - CVE-2025-61987
SQL injection (CWE-89) - CVE-2025-62192
Initialization of a resource with an insecure default (CWE-1188) - CVE-2025-64781
This can be exploited only when External page display restriction is set as "Do not limit", as in the initial configurationReflected cross-site scripting (CWE-79) - CVE-2025-65120
Stored cross-site scripting (CWE-79) - CVE-2025-66284

The following people reported these vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2025-53523 Reporter: Shogo Iyota of GMO Cybersecurity by Ierae Gaku Mochizuki, Tsutomu Aramaki, and Taiga Shirakura of Mitsui Bussan Secure Directions, Inc. Natsumi Furukawa CVE-2025-54407 Reporter: Toshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc. CVE-2025-57883 Reporter: Tsuyuki Takumi of Mitsui Bussan Secure Directions, Inc. Ryo Sato CVE-2025-58576 Rep…