CVE-2025-66824 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Meeting location field of the Create/Edit Conference functionality in TrueConf Server v5.5.2.108…
High CVSS: 8.7

CVE-2025-66824

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Meeting location field of the Create/Edit Conference functionality in TrueConf Server v5.5.2.10813. The injected payload is stored via the meeting_room parameter and executed when users visit the Conference Info page, allowing attackers to achieve full Account Takeover (ATO). This issue is caused by improper sanitization of user-supplied input in the meeting_room field.
Vendor
Trueconf
Product
Server
CWE
CWE-79
Yayın Tarihi
2025-12-30 19:15:44
Güncelleme
2026-01-07 15:41:22
Source Identifier
cve@mitre.org
KEV Date Added
-

Kategoriler

CWE-79 Server HIGH Trueconf 2025

Referanslar

https://github.com/x00nullbit/CVE-References/blob/main/CVE-2025-66824/README.md https://trueconf.com https://github.com/x00nullbit/CVE-References/blob/main/CVE-2025-66824/README.md