CVE-2026-54216: TeamDavid: Reflected Cross Site Scripting (XSS) via the 'EntryInfo' parameter
Tobit Laboratories AG TeamDavid's Webbox application contains a reflected cross-site scripting (XSS) vulnerability. By sending a specially crafted link including an arbitrary path, an XSS payload or the parameter “EntryInfo”, and the parameter “!templateName=entryMail”, an attacker can cause the payload to execute in the victim’s browser when they click the link. This issue affects TeamDavid through Rollout 524.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54216?
CVE-2026-54216 has a risk score of 37, indicating a moderate severity for the reflected cross-site scripting vulnerability.
How does CVE-2026-54216 affect user security?
CVE-2026-54216 affects user security by allowing attackers to execute arbitrary scripts in the context of a user's browser, potentially leading to data theft or account compromise.
What are the potential impacts of exploiting CVE-2026-54216?
Exploiting CVE-2026-54216 could allow attackers to steal cookies, session tokens, or manipulate web content, resulting in unauthorized actions performed on behalf of the victim.
How can I mitigate the risks associated with CVE-2026-54216?
To mitigate CVE-2026-54216, ensure proper sanitization and validation of user inputs, especially for parameters like 'EntryInfo' in the TeamDavid application.
Is there a patch available for CVE-2026-54216?
At this time, there is no specific patch available for CVE-2026-54216, so users should apply security best practices until a fix is released by Tobit Laboratories AG.