PT-2025-54215 · Trueconf · Trueconf Server

X00Nullbit · Published 2025-12-30 · Updated 2026-01-02 · CVE-2025-66824

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions TrueConf Server version 5.5.2.10813

Description A Stored Cross-Site Scripting (XSS) issue exists in the Meeting location field within the Create/Edit Conference functionality. The issue is due to improper sanitization of user-supplied input in the meeting room parameter. An attacker can inject a malicious payload into the meeting room parameter, which is then stored and executed when users access the Conference Info page. Successful exploitation of this issue can lead to full Account Takeover (ATO).

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting or disabling the Create/Edit Conference functionality until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-04922

CVE-2025-66824

Affected Products

Trueconf Server

References · 10

• 🔥 https://github.com/x00nullbit/CVE-References/blob/main/CVE-2025-66824/README.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-66824 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04922 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-66824 · Security Note
• https://twitter.com/VulmonFeeds/status/2006156540126912515 · Twitter Post
• https://trueconf.ru/blog/update/trueconf-server-5-5-3 · Note
• https://t.me/cveNotify/147528 · Telegram Post
• https://twitter.com/CVEnew/status/2006861551165120911 · Twitter Post
• https://t.me/CVEtracker/40989 · Telegram Post
• https://trueconf.com · Note