What’s Vulnerable › Vulnerabilities

CVE-2025-66823

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-30 · updated 2026-08-20
• Weakness: CWE-79

Description

An HTML Injection vulnerability in TrueConf server 5.5.2.10813 in the conference description field allows an attacker to inject arbitrary HTML in the Create/Edit conference functionality. The payload will be triggered when the victim opens the Conference Info page ([conference url]/info).

Affected products

• Trueconf Server: 5.5.2.10813

References

• https://github.com/x00nullbit/CVE-References/blob/main/CVE-2025-66823/README.md
• https://trueconf.com
• https://github.com/x00nullbit/CVE-References/blob/main/CVE-2025-66823/README.md

Get alerted when CVE-2025-66823 or the next vulnerability affects your stack