Most recent entries from all

EUVD-2026-263437

2026-10-06T18:09:15.872666+00:00

EUVD-2026-263437

fkie_cve-2025-66284

2026-10-06T18:09:15.872724+00:00

Stored cross-site scripting vulnerabilities exist in GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION prior to ver5.7.1. A logged-in user can prepare a malicious page or URL, and an arbitrary script may be executed on the web browser when another user accesses it.

GHSA-gvxm-fhfx-8g6r

2026-10-06T18:09:15.872774+00:00

jvndb-2025-000113

2026-10-06T18:09:15.872802+00:00

GroupSession provided by Japan Total System Co.,Ltd. contains multiple vulnerabilities listed below.

Stored cross-site scripting (CWE-79) - CVE-2025-53523
Stored cross-site scripting (CWE-79) - CVE-2025-54407
Reflected cross-site scripting (CWE-79) - CVE-2025-57883
Cross-site request forgery (CWE-352) - CVE-2025-58576
Authorization bypass through user-controlled key (CWE-639) - CVE-2025-61950
Missing origin validation in webSockets (CWE-1385) - CVE-2025-61987
SQL injection (CWE-89) - CVE-2025-62192
Initialization of a resource with an insecure default (CWE-1188) - CVE-2025-64781
This can be exploited only when External page display restriction is set as "Do not limit", as in the initial configurationReflected cross-site scripting (CWE-79) - CVE-2025-65120
Stored cross-site scripting (CWE-79) - CVE-2025-66284

The following people reported these vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2025-53523 Reporter: Shogo Iyota of GMO Cybersecurity by Ierae Gaku Mochizuki, Tsutomu Aramaki, and Taiga Shirakura of Mitsui Bussan Secure Directions, Inc. Natsumi Furukawa CVE-2025-54407 Reporter: Toshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc. CVE-2025-57883 Reporter: Tsuyuki Takumi of Mitsui Bussan Secure Directions, Inc. Ryo Sato CVE-2025-58576 Rep…