PT-2025-50880 · Unknown · Groupsession

Published 2025-12-12 · Updated 2025-12-12 · CVE-2025-66284

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GroupSession versions prior to 5.7.1

Description Stored cross-site scripting vulnerabilities exist. A logged-in user can create a malicious page or URL, potentially leading to the execution of arbitrary scripts in another user's web browser upon access.

Recommendations Update GroupSession to version 5.7.1 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-66284

Affected Products

Groupsession

References · 5

• https://groupsession.jp/info/info-news/security20251208 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66284 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66284 · Vendor Advisory
• https://t.me/CVEtracker/39573 · Telegram Post
• https://jvn.jp/en/jp/JVN19940619 · Note