CVE-2025-54407

MediumCVSS 5.1/10Last modified Oct 7, 2026

Description

Stored cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2. If a user accesses a crafted page or URL, an arbitrary script may be executed on the web browser of the user.

Metrics

CVSS 4.0 5.1/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Japan Total System Co.,Ltd.	GroupSession Free edition	prior to ver5.3.0
Japan Total System Co.,Ltd.	GroupSession byCloud	prior to ver5.3.3
Japan Total System Co.,Ltd.	GroupSession ZION	prior to ver5.3.2

References

https://groupsession.jp/info/info-news/security20251208Vendor Advisory
https://jvn.jp/en/jp/JVN19940619/Third Party Advisory

Timeline

Published: Dec 12, 2025
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-544095.5AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE CVE-2025-54419.8A vulnerability classified as critical was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.CVE-2025-544105.2Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and va CVE-2025-544115.4Discourse is an open-source discussion platform. Welcome banner user name string for logged in users can be vulnerable to XSS attacks, which CVE-2025-544128.7skops is a Python library which helps users share and ship their scikit-learn based models. Versions 0.11.0 and below contain a inconsistenc CVE-2025-544138.7skops is a Python library which helps users share and ship their scikit-learn based models. Versions 0.11.0 and below contain an inconsisten CVE-2025-544145.1Anubis is a Web AI Firewall Utility that weighs the soul of users' connections using one or more challenges in order to protect upstream res CVE-2025-544159.1dag-factory is a library for Apache Airflow® to construct DAGs declaratively via configuration files. In versions 0.23.0a8 and below, a high CVE-2025-544169.1tj-actions/branch-names is a Github actions repository that contains workflows to retrieve branch or tag names with support for all events. CVE-2025-544178.8Craft is a platform for creating digital experiences. Versions 4.13.8 through 4.16.2 and 5.5.8 through 5.8.3 contain a vulnerability that ca CVE-2025-544189.8CodeIgniter is a PHP full-stack web framework. A command injection vulnerability present in versions prior to 4.6.2 affects applications tha CVE-2025-5441910.0A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the (unsigned) origin