EUVD-2026-54447
GHSA-7rcg-qcqc-wfpx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered reflected XSS, no auth needed, requires victim click (UI:R), scope changes to browser context (S:C); C:L/I:L for session and DOM exposure, no availability impact.
Primary rating from Vendor (NCSC.ch).
CVSS VectorVendor: NCSC.ch
Lifecycle Timeline
1DescriptionCVE.org
Tobit Laboratories AG TeamDavid's Webbox application contains a reflected cross-site scripting (XSS) vulnerability. By sending a specially crafted link including an arbitrary path, an XSS payload or the parameter “EntryInfo”, and the parameter “!templateName=entryMail”, an attacker can cause the payload to execute in the victim’s browser when they click the link. This issue affects TeamDavid through Rollout 524.
AnalysisAI
Reflected XSS in the Webbox component of Tobit Laboratories AG's TeamDavid collaboration platform (marketed as a secure Microsoft 365 alternative) allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link. The vulnerability is exploitable via three distinct injection points: the URL path, the EntryInfo query parameter, and the !templateName=entryMail parameter. Disclosed as part of a coordinated batch of 22 CVEs in TeamDavid by InfoGuard Labs and reported through NCSC.ch; no public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
The vulnerability resides in the Webbox web application component of TeamDavid, a European collaboration suite developed by Tobit Laboratories AG. Per CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), the root cause is the server's failure to sanitize or HTML-encode user-supplied input before including it in HTTP responses. Three distinct reflection points are confirmed: arbitrary URL path segments, the EntryInfo query parameter, and the !templateName=entryMail parameter - indicating broad and under-validated input handling in the Webbox rendering pipeline. The CPE string cpe:2.3:a:tobit_laboratories_ag:teamdavid:*:*:*:*:*:*:*:* covers all versions through Rollout 524. Because TeamDavid is a web-based collaboration platform handling internal communications, successful exploitation could expose session tokens, user credentials, or internal message content to an attacker-controlled endpoint.
RemediationAI
Upstream fix available per vendor advisory - consult the release notes at https://david.tobit.software/releasenotes to identify the patched rollout version. No specific patched rollout number is independently confirmed in the available data; administrators should verify whether a rollout beyond 524 has been released and apply it promptly. As a compensating control pending patching, deploying a web application firewall rule to strip or block common XSS payload patterns (script tags, event handlers, javascript: URIs) in the EntryInfo parameter, !templateName parameter, and URL path to the Webbox endpoint can reduce exposure. If Webbox does not require external internet access, restricting the endpoint to internal network ranges at the perimeter removes the remote attack vector entirely with no functional impact for internal-only deployments. Users should be advised not to click unsolicited links pointing to TeamDavid Webbox, particularly those with unusual query strings.
Denial of service with potential for remote code execution affects Tobit Laboratories' TeamDavid (David Webbox) groupwar
Denial of service, and potentially remote code execution, in Tobit Laboratories' David (TeamDavid/Webbox) collaboration
Denial of service (with conditional remote code execution potential) affects Tobit Laboratories AG's TeamDavid groupware
Persistent denial of service in Tobit Laboratories AG's TeamDavid (David/Webbox groupware) allows any remote, unauthenti
Unauthenticated memory disclosure in Tobit Laboratories' David (TeamDavid) groupware through Rollout 524 lets remote att
Remote denial-of-service in Tobit Laboratories AG TeamDavid's Webbox application allows unauthenticated network attacker
Hard-coded cryptographic key exposure in Tobit Laboratories TeamDavid Webbox allows any attacker who obtains server-side
Arbitrary file write in the Webbox component of Tobit Laboratories AG TeamDavid (through Rollout 524) allows unauthentic
Path traversal in Tobit Laboratories AG TeamDavid's Webbox archive creation functionality allows authenticated low-privi
File disclosure in Tobit Laboratories AG's TeamDavid Webbox (through Rollout 524) allows authenticated network users to
Arbitrary file deletion in Tobit TeamDavid's Webbox component allows authenticated users to permanently delete any file
Unauthenticated NTLM credential theft is possible against Tobit Laboratories AG TeamDavid's Webbox component through Rol
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today