CVE-2025-53523 MEDIUM

CVE-2025-53523

Vendor Japan Total System Co.,Ltd.
Product GroupSession Free edition
Weakness CWE-79 · XSS
Published December 12, 2025
Last update December 12, 2025

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Stored cross-site scripting vulnerabilities exist in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2. A logged-in user can prepare a malicious page or URL, and an arbitrary script may be executed on the web browser when another user accesses it.

Key dates

02Disclosure timeline

December 12, 2025 CVE published
December 12, 2025 Record updated