CVE-2025-66823

5.4 mediumEPSS 0.2%

Medium (5.4) in trueconf trueconf server. EPSS 0.2% chance of exploitation in the next 30 days.

An HTML Injection vulnerability in TrueConf server 5.5.2.10813 in the conference description field allows an attacker to inject arbitrary HTML in the Create/Edit conference functionality. The payload will be triggered when the victim opens the Conference Info page ([conference url]/info).

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 9% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2025-12-30
Modified: 2026-08-20
Record from: the NVD, synced 2026-10-19

Affected

trueconf:trueconf_server

References

https://github.com/x00nullbit/CVE-References/blob/main/CVE-2025-66823/README.md
https://trueconf.com
https://github.com/x00nullbit/CVE-References/blob/main/CVE-2025-66823/README.md

Check your stack JSON