CVE-2025-66824: XSS

Published Dec 30, 2025

Updated

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Meeting location field of the Create/Edit Conference functionality in TrueConf Server v5.5.2.10813. The injected payload is stored via the meetingroom parameter and executed when users visit the Conference Info page, allowing attackers to achieve full Account Takeover (ATO). This issue is caused by improper sanitization of user-supplied input in the meetingroom field.

Affected Software

2 affected components

TrueConf TrueConf Server

TrueConf Trueconf Server Windows=5.5.2.10813

Event History

Dec 30, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·07:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-66824?

CVE-2025-66824 is rated as a high severity vulnerability due to its potential for exploiting stored Cross-Site Scripting (XSS).

How do I fix CVE-2025-66824?

To mitigate CVE-2025-66824, update TrueConf Server to the latest version or implement proper input validation and output encoding in the meeting_room parameter.

What type of vulnerability is CVE-2025-66824?

CVE-2025-66824 is classified as a Stored Cross-Site Scripting (XSS) vulnerability.

Which version of TrueConf Server is affected by CVE-2025-66824?

TrueConf Server version 5.5.2.10813 is affected by CVE-2025-66824.

What are the potential consequences of CVE-2025-66824?

Exploitation of CVE-2025-66824 could lead to unauthorized actions performed by users, including data theft and session hijacking.