Priority CRITICAL 100KEV
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the is…
CVSS 4.0CRITICAL 9.5· Network · No auth · No interaction · EPSS 0.01686 · Published 2026-08-19 · Fixed in 5.3.9, 5.4.9 +1 CWE-94
Priority CRITICAL 99KEV
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumente…
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.01464 · Published 2026-08-19 · Fixed in 5.3.9, 5.4.9 +1 CWE-306
Priority CRITICAL 93KEV
TrueConf Client downloads application update code and applies it without performing verification.
CVSS 3.1HIGH 7.8· Adjacent network · High privileges · User interaction · EPSS 0.05845 · Published 2026-03-30 · No fix listed CWE-494
Priority HIGH 73
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Meeting location field of the Create/Edit Conference functionality in TrueConf Server v5.5.2.10813.
CVSS 3.1HIGH 8.7· Network · Low privileges · User interaction · EPSS 0.00312 · Published 2025-12-30 · No fix listed CWE-79
Priority HIGH 67
A CSV Formula Injection vulnerability in TrueConf Server v5.5.2.10813 allows a normal user to inject malicious spreadsheet formulas into exported chat logs via crafted Display Name.
CVSS 3.1HIGH 7.3· Network · Low privileges · User interaction · EPSS 0.00312 · Published 2025-12-30 · No fix listed CWE-1236
Priority HIGH 66
TrueConf Client 8.5.2 is vulnerable to DLL hijacking via crafted wfapi.dll allowing local attackers to execute arbitrary code within the user's context.
CVSS 3.1HIGH 7.1· Local · Low privileges · No interaction · EPSS 0.00183 · Published 2025-12-30 · No fix listed CWE-427
Priority MEDIUM 60
A vulnerability classified as problematic has been found in TrueConf Server 4.3.7.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00726 · Published 2022-06-29 · No fix listed CWE-601
Priority MEDIUM 58
An HTML Injection vulnerability in TrueConf server 5.5.2.10813 in the conference description field allows an attacker to inject arbitrary HTML in the Create/Edit conference functionality.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00193 · Published 2025-12-30 · No fix listed CWE-79
Priority MEDIUM 58
A vulnerability was found in TrueConf Server 4.3.7.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00622 · Published 2022-06-29 · No fix listed CWE-80
Priority MEDIUM 58
A vulnerability was found in TrueConf Server 4.3.7.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00622 · Published 2022-06-29 · No fix listed CWE-80
Priority MEDIUM 58
A vulnerability was found in TrueConf Server 4.3.7.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00622 · Published 2022-06-29 · No fix listed CWE-80
Priority MEDIUM 58
A vulnerability was found in TrueConf Server 4.3.7 and classified as problematic.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00622 · Published 2022-06-29 · No fix listed CWE-80
Priority MEDIUM 58
A vulnerability has been found in TrueConf Server 4.3.7 and classified as problematic.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00622 · Published 2022-06-29 · No fix listed CWE-80
Priority MEDIUM 58
A vulnerability, which was classified as problematic, was found in TrueConf Server 4.3.7.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00622 · Published 2022-06-29 · No fix listed CWE-80
Priority MEDIUM 53
A SQL injection issue in the web API in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows remote unauthenticated attackers to execute arbitrary SQL commands, ultimately leading to remote code execution.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0232 · Published 2022-12-27 · Fixed in 5.2.6.10025 CWE-89
Priority MEDIUM 42
A SQL injection issue in a database stored function in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows a low-privileged database user to execute arbitrary SQL commands as the database administrator, resulting i…
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01156 · Published 2022-12-27 · Fixed in 5.2.6.10025 CWE-89
Priority LOW 39
A vulnerability classified as problematic was found in TrueConf Server 4.3.7.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00503 · Published 2022-06-29 · No fix listed CWE-352
THREATIST.IORead the docs