CVE-2025-65120: Groupsession

Medium severity, CVSS 5.1. EPSS: 0.2% chance of exploitation in the next 30 days.

Reflected cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION prior to ver5.7.1. If a user accesses a crafted page or URL, an arbitrary script may be executed on the web browser of the user.

Affected products

• Groupsession Groupsession: before 5.7.1 (fixed in 5.7.1)

Published 2025-12-12. Last modified 2026-10-07.