Vulnerability record · CVE-2025-66824 · published 30 December 2025

CVE-2025-66824: Trueconf server cross-site scripting vulnerability

Trueconf · Trueconf Server

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Meeting location field of the Create/Edit Conference functionality in TrueConf Server v5.5.2.10813. The injected payload is stored via the meeting_room parameter and executed when users visit the Conference Info page, allowing attackers to achieve full Account Takeover (ATO). This issue is caused by improper sanitization of user-supplied input in the meeting_room field.

8.7 CVSS 3.1 High EPSS 0.31% · top 78.5% CWE-79 · Cross-site scripting

8.7CVSS 3.1 base score

0.31%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

3References, 2 tagged exploit

20 Aug 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Trueconf Server Trueconf

References

Link	Tags
https://github.com/x00nullbit/CVE-References/blob/main/CVE-2025-66824/README.md	ExploitThird Party Advisory
https://trueconf.com	Product
https://github.com/x00nullbit/CVE-References/blob/main/CVE-2025-66824/README.md	ExploitThird Party Advisory

Track CVE-2025-66824 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.5CVE-2026-72530TrueConf Server sandbox breakout via crafted script code injectionTrueConf Server versions 5.3.X through 5.3.9, 5.4.X through 5.4.9, 5.5.X through 5.5.5 and earlier allow a remote unauthenticated attacker to break o…KEVEPSS 1.7%analysed19 Aug 2026 9.3CVE-2026-72529TrueConf Server missing authentication allows remote script executionTrueConf Server versions 5.3.X through 5.3.9, 5.4.X through 5.4.9, 5.5.X through 5.5.5, and earlier expose an undocumented function on port 4307/TCP …KEVEPSS 1.5%analysed19 Aug 2026 8.8CVE-2017-20120Trueconf server cross-site request forgery vulnerabilityA vulnerability classified as problematic was found in TrueConf Server 4.3.7. This vulnerability affects unknown code of the file /admin/service/stop…EPSS 0.49%29 Jun 2022 7.3CVE-2025-66834Trueconf server csv injection vulnerabilityA CSV Formula Injection vulnerability in TrueConf Server v5.5.2.10813 allows a normal user to inject malicious spreadsheet formulas into exported cha…EPSS 0.31%30 Dec 2025 5.4CVE-2025-66823Trueconf server cross-site scripting vulnerabilityAn HTML Injection vulnerability in TrueConf server 5.5.2.10813 in the conference description field allows an attacker to inject arbitrary HTML in the…EPSS 0.19%30 Dec 2025 6.1CVE-2026-42897Microsoft Exchange Server XSS enables spoofingMicrosoft Exchange Server and Exchange Server Subscription Edition fail to neutralize input during web page generation, a cross-site scripting flaw (…KEVEPSS 0.52%analysed14 May 2026 6.1CVE-2025-48700Zimbra Classic UI stored XSS via crafted email HTMLZimbra Collaboration Suite Classic UI fails to properly sanitize HTML content in email messages, allowing crafted tag structures and attribute values…KEVEPSS 1.7%analysed23 Jun 2025 6.1CVE-2025-66376Zimbra Collaboration Classic UI stored XSS via CSS @import in emailZimbra Collaboration Suite 10 before 10.0.18 and 10.1 before 10.1.13 allows stored cross-site scripting in the Classic UI through CSS @import directi…KEVEPSS 20%analysed5 Jan 2026

Source: NIST National Vulnerability Database (record CVE-2025-66824), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.