CVE-2025-66284: Groupsession

Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days.

Stored cross-site scripting vulnerabilities exist in GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION prior to ver5.7.1. A logged-in user can prepare a malicious page or URL, and an arbitrary script may be executed on the web browser when another user accesses it.

Affected products

• Groupsession Groupsession: before 5.7.1 (fixed in 5.7.1)

Published 2025-12-12. Last modified 2026-10-07.