PT-2025-54221 · Trueconf · Trueconf

X00Nullbit · Published 2025-12-30 · Updated 2026-01-02 · CVE-2025-66823

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TrueConf versions 5.5.2.10813

Description A flaw exists in TrueConf server version 5.5.2.10813 that allows for the injection of arbitrary HTML code through the conference description field. This issue is present in the Create/Edit conference functionality and is triggered when a victim accesses the Conference Info page at the URL /info. The injected HTML can be used to compromise the integrity of the displayed information.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, sanitize all user-supplied input for the conference description field to prevent HTML injection.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-04921

CVE-2025-66823

Affected Products

Trueconf

References · 9

• 🔥 https://github.com/x00nullbit/CVE-References/blob/main/CVE-2025-66823/README.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-66823 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66823 · Security Note
• https://bdu.fstec.ru/vul/2026-04921 · Security Note
• https://twitter.com/CVEnew/status/2006861550229787133 · Twitter Post
• https://trueconf.ru/blog/update/trueconf-server-5-5-3 · Note
• https://t.me/cveNotify/147531 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2006138622307676301 · Twitter Post
• https://trueconf.com · Note