CVE-2025-66823

PoC —

CVSS 3.1

5.4 medium

EPSS

<1%p9

Published

Dec 30, 2025 (Dec 30, 2025)

Modified

Aug 20, 2026

Description

An HTML Injection vulnerability in TrueConf server 5.5.2.10813 in the conference description field allows an attacker to inject arbitrary HTML in the Create/Edit conference functionality. The payload will be triggered when the victim opens the Conference Info page ([conference url]/info).

Vendors: trueconf
Products: trueconf server
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news0 stories

No ingested article mentions this CVE yet.