CVE Intelligence

Vulnerabilidades do Trueconf Trueconf Server

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Trueconf Trueconf Server: 5 registro(s), com versões afetadas e correções.
cpe:2.3:a:trueconf:trueconf_server

CVE-2026-72530 Crítica · 9.0 KEV Alta · 62 Exploit público CWE-94 19/08/2026
TrueConf Server Code Injection Vulnerability
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.
CVE-2026-72529 Crítica · 9.8 KEV Alta · 59 CWE-306 19/08/2026
TrueConf Server Missing Authentication for Critical Function Vulnerability
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function.
CVE-2025-66823 Média · 5.4 CWE-79 30/12/2025
Cross-site Scripting (XSS) em Trueconf Trueconf Server
An HTML Injection vulnerability in TrueConf server 5.5.2.10813 in the conference description field allows an attacker to inject arbitrary HTML in the Create/Edit conference functionality. The payload will be triggered when the victim opens the Conference Info page ([conference url]/info).
CVE-2025-66834 Alta · 7.3 CWE-1236 30/12/2025
CSV Injection em Trueconf Trueconf Server
A CSV Formula Injection vulnerability in TrueConf Server v5.5.2.10813 allows a normal user to inject malicious spreadsheet formulas into exported chat logs via crafted Display Name.
CVE-2025-66824 Alta · 8.7 CWE-79 30/12/2025
Cross-site Scripting (XSS) em Trueconf Trueconf Server
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Meeting location field of the Create/Edit Conference functionality in TrueConf Server v5.5.2.10813. The injected payload is stored via the meeting_room parameter and executed when users visit the Conference Info page, allowing attackers to achieve full Account Takeover (ATO). This issue is caused by improper sanitization of user-supplied input in the meeting_room field.