Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.8

GroupSession Free, byCloud, and ZION versions before 5.7.1 allow malicious user pages to execute code

CVE-2025-66284 · published 10 months ago
Summary

A malicious user can prepare a web page or URL that can harm other users' web browsers when they visit it. This could allow the attacker to steal sensitive information or take control of the user's session. To fix this, update to version 5.7.1 or later, and ensure users are cautious when clicking on links or visiting unknown websites.

What to do
  • Update groupsession groupsession to version 5.7.1 or later.
Affected software
VendorProductAffected versions
groupsession groupsession < 5.7.1
cpe:2.3:a:groupsession:groupsession:*:*:*:*:bycloud:*:*:*
Original advisory text
Stored cross-site scripting vulnerabilities exist in GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION prior to ver5.7.1. A logged-in user c...
Stored cross-site scripting vulnerabilities exist in GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION prior to ver5.7.1. A logged-in user can prepare a malicious page or URL, and an arbitrary script may be executed on the web browser when another user accesses it.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
4.8 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published12 Dec 2025
Updated26 Oct 2026
First seen6 Mar 2026
Sources
CVE-2025-66284 · NVD
Track software like this
Free during beta