CVE-2025-66284

Unknown Unknown - Not Provided

Stored XSS in GroupSession Versions Prior to 5.7.1 Allows Script Execution

Publication date: 2025-12-12

Last updated on: 2026-02-17

Assigner: JPCERT/CC

Description

Stored cross-site scripting vulnerabilities exist in GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION prior to ver5.7.1. A logged-in user can prepare a malicious page or URL, and an arbitrary script may be executed on the web browser when another user accesses it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-12

Last Modified

2026-02-17

Generated

2026-07-06

AI Q&A

2025-12-12

EPSS Evaluated

2026-07-04

NVD

CVE-2025-66284

EUVD

EUVD-2025-203025

Affected Vendors & Products

Vendor	Product	Version / Range
groupsession	groupsession	to 5.7.1 (exc)
groupsession	groupsession	to 5.7.1 (exc)
groupsession	groupsession	to 5.7.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) issue in GroupSession products prior to version 5.7.1. A logged-in user can create a malicious page or URL that contains a script. When another user accesses this page or URL, the malicious script executes in their web browser.

Impact Analysis

The vulnerability can allow an attacker to execute arbitrary scripts in the context of another user's browser. This can lead to unauthorized actions, data theft, session hijacking, or other malicious activities affecting users of the GroupSession application.

Mitigation Strategies

Users are advised to update GroupSession to version 5.7.1 or later to mitigate this stored cross-site scripting vulnerability. [2]

Hi! I’m here to help you understand CVE-2025-66284. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70