CVE-2025-53523

Unknown Unknown - Not Provided

Stored XSS in GroupSession Allows Script Execution via Malicious URLs

Publication date: 2025-12-12

Last updated on: 2026-02-17

Assigner: JPCERT/CC

Description

Stored cross-site scripting vulnerabilities exist in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2. A logged-in user can prepare a malicious page or URL, and an arbitrary script may be executed on the web browser when another user accesses it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-12

Last Modified

2026-02-17

Generated

2026-07-06

AI Q&A

2025-12-12

EPSS Evaluated

2026-07-05

NVD

CVE-2025-53523

EUVD

EUVD-2025-203026

Affected Vendors & Products

Vendor	Product	Version / Range
groupsession	groupsession	to 5.3.3 (exc)
groupsession	groupsession	to 5.3.0 (exc)
groupsession	groupsession	to 5.3.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Mitigation Strategies

Users are advised to update GroupSession to the latest versions provided by the vendor to mitigate this vulnerability. [2]

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) issue in GroupSession products before certain versions. A logged-in user can create a malicious page or URL that, when accessed by another user, executes arbitrary scripts in their web browser.

Impact Analysis

The vulnerability can allow attackers to execute arbitrary scripts in the browsers of other users, potentially leading to unauthorized actions, data theft, or session hijacking when users access the malicious content.

Hi! I’m here to help you understand CVE-2025-53523. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70