Cybozu Garoon
Monthly
Cross-site scripting in Cybozu Garoon allows a low-privilege authenticated attacker to inject and execute arbitrary JavaScript in the browsers of other logged-in users. The scope-changed CVSS vector (S:C) confirms this is a persistent or reflected XSS capable of crossing session boundaries, enabling high-integrity impact against victim accounts. No public exploit code or CISA KEV listing has been identified at time of analysis, but JPCERT/CC coordinated disclosure signals active vendor engagement.
Cross-site scripting in Cybozu Garoon allows a low-privilege authenticated attacker to inject and execute arbitrary JavaScript in the browsers of other logged-in users. The scope-changed CVSS vector (S:C) confirms this is a persistent or reflected XSS capable of crossing session boundaries, enabling high-integrity impact against victim accounts. No public exploit code or CISA KEV listing has been identified at time of analysis, but JPCERT/CC coordinated disclosure signals active vendor engagement.