Trueconf
Monthly
Remote code execution in TrueConf Server (versions 5.3.x through 5.3.9, 5.4.x through 5.4.9, 5.5.x through 5.5.5, and earlier) allows an unauthenticated network attacker reaching TCP port 4307 to submit a specially crafted script that escapes the product's isolated/sandboxed execution environment and runs arbitrary code on the underlying host. Reported by Kaspersky ICS-CERT and classified as CWE-94 code injection, the flaw carries a CVSS 4.0 base score of 9.5 driven by full confidentiality, integrity, and availability impact on both the vulnerable component and the host system it breaks out to. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the sandbox-escape-to-host primitive makes it a high-value target.
Remote unauthenticated code execution in TrueConf Server (versions through 5.3.9, 5.4.9, and 5.5.5) allows a network attacker reachable on port 4307/TCP to invoke an undocumented function and run an arbitrary script without any authentication. Rooted in a missing authentication check (CWE-306) on a critical function, this flaw was disclosed by Kaspersky ICS-CERT and carries a CVSS 4.0 base score of 9.3. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitation profile makes it a high remediation priority.
Arbitrary code execution in TrueConf Client allows authenticated attackers on adjacent networks to deliver malicious updates due to missing integrity verification. The auto-update mechanism accepts unsigned or unverified payloads, enabling man-in-the-middle attackers with high privileges to substitute trojanized updates that execute with the application's permissions. EPSS data not available; no confirmed active exploitation (not in CISA KEV); publicly available exploit code not identified at time of analysis. CVSS 7.8 reflects the adjacent network attack vector and user interaction requirement, reducing immediate internet-scale risk.
Stored HTML injection (CWE-79) in TrueConf Server 5.5.2.10813 on Windows enables an authenticated attacker to embed arbitrary HTML into a conference's description field, which executes in the browser of any user who visits the Conference Info page at [conference_url]/info. The CVSS Scope Change (S:C) reflects cross-context impact - payloads escape the originating session and execute within victims' browser contexts, enabling session hijacking or phishing. A public proof-of-concept is confirmed on GitHub; however, EPSS at 0.17% (7th percentile) and absence from CISA KEV indicate no known widespread exploitation at time of analysis.
Local code execution in TrueConf Client 8.5.2 lets an already-authenticated local user run arbitrary code in the context of the victim user by planting a malicious wfapi.dll that the application loads insecurely (CWE-427). Publicly available exploit code exists, but there is no public exploit identified in the sense of active exploitation - it is not listed in CISA KEV and EPSS is low (0.17%, 6th percentile), indicating little observed real-world exploitation activity. The impact is confined to the current user's context (no privilege escalation to SYSTEM claimed).
CSV formula injection in TrueConf Server 5.5.2.10813 on Windows allows an authenticated low-privileged user to embed malicious spreadsheet formulas into exported chat logs by setting a crafted Display Name. When an administrator or privileged user exports those chat logs to CSV and opens the file in spreadsheet software such as Microsoft Excel or LibreOffice Calc, the injected formula executes in the context of the victim's workstation, potentially enabling OS command execution or data exfiltration. A publicly available proof-of-concept exists; EPSS probability is low at 0.27% (20th percentile), and the vulnerability is not currently listed in the CISA KEV catalog.
Stored XSS in TrueConf Server 5.5.2.10813 on Windows enables authenticated low-privileged users to inject malicious JavaScript via the meeting_room parameter in the conference creation/editing interface. The payload persists server-side and executes in any victim's browser upon visiting the Conference Info page, enabling full Account Takeover (ATO). A publicly available proof-of-concept exploit exists; the CVE is not listed in CISA KEV at time of analysis.
A SQL injection issue in the web API in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows remote unauthenticated attackers to execute arbitrary SQL commands, ultimately leading to remote code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A SQL injection issue in a database stored function in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows a low-privileged database user to execute arbitrary SQL commands as the database. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Remote code execution in TrueConf Server (versions 5.3.x through 5.3.9, 5.4.x through 5.4.9, 5.5.x through 5.5.5, and earlier) allows an unauthenticated network attacker reaching TCP port 4307 to submit a specially crafted script that escapes the product's isolated/sandboxed execution environment and runs arbitrary code on the underlying host. Reported by Kaspersky ICS-CERT and classified as CWE-94 code injection, the flaw carries a CVSS 4.0 base score of 9.5 driven by full confidentiality, integrity, and availability impact on both the vulnerable component and the host system it breaks out to. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the sandbox-escape-to-host primitive makes it a high-value target.
Remote unauthenticated code execution in TrueConf Server (versions through 5.3.9, 5.4.9, and 5.5.5) allows a network attacker reachable on port 4307/TCP to invoke an undocumented function and run an arbitrary script without any authentication. Rooted in a missing authentication check (CWE-306) on a critical function, this flaw was disclosed by Kaspersky ICS-CERT and carries a CVSS 4.0 base score of 9.3. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitation profile makes it a high remediation priority.
Arbitrary code execution in TrueConf Client allows authenticated attackers on adjacent networks to deliver malicious updates due to missing integrity verification. The auto-update mechanism accepts unsigned or unverified payloads, enabling man-in-the-middle attackers with high privileges to substitute trojanized updates that execute with the application's permissions. EPSS data not available; no confirmed active exploitation (not in CISA KEV); publicly available exploit code not identified at time of analysis. CVSS 7.8 reflects the adjacent network attack vector and user interaction requirement, reducing immediate internet-scale risk.
Stored HTML injection (CWE-79) in TrueConf Server 5.5.2.10813 on Windows enables an authenticated attacker to embed arbitrary HTML into a conference's description field, which executes in the browser of any user who visits the Conference Info page at [conference_url]/info. The CVSS Scope Change (S:C) reflects cross-context impact - payloads escape the originating session and execute within victims' browser contexts, enabling session hijacking or phishing. A public proof-of-concept is confirmed on GitHub; however, EPSS at 0.17% (7th percentile) and absence from CISA KEV indicate no known widespread exploitation at time of analysis.
Local code execution in TrueConf Client 8.5.2 lets an already-authenticated local user run arbitrary code in the context of the victim user by planting a malicious wfapi.dll that the application loads insecurely (CWE-427). Publicly available exploit code exists, but there is no public exploit identified in the sense of active exploitation - it is not listed in CISA KEV and EPSS is low (0.17%, 6th percentile), indicating little observed real-world exploitation activity. The impact is confined to the current user's context (no privilege escalation to SYSTEM claimed).
CSV formula injection in TrueConf Server 5.5.2.10813 on Windows allows an authenticated low-privileged user to embed malicious spreadsheet formulas into exported chat logs by setting a crafted Display Name. When an administrator or privileged user exports those chat logs to CSV and opens the file in spreadsheet software such as Microsoft Excel or LibreOffice Calc, the injected formula executes in the context of the victim's workstation, potentially enabling OS command execution or data exfiltration. A publicly available proof-of-concept exists; EPSS probability is low at 0.27% (20th percentile), and the vulnerability is not currently listed in the CISA KEV catalog.
Stored XSS in TrueConf Server 5.5.2.10813 on Windows enables authenticated low-privileged users to inject malicious JavaScript via the meeting_room parameter in the conference creation/editing interface. The payload persists server-side and executes in any victim's browser upon visiting the Conference Info page, enabling full Account Takeover (ATO). A publicly available proof-of-concept exploit exists; the CVE is not listed in CISA KEV at time of analysis.
A SQL injection issue in the web API in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows remote unauthenticated attackers to execute arbitrary SQL commands, ultimately leading to remote code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A SQL injection issue in a database stored function in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows a low-privileged database user to execute arbitrary SQL commands as the database. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.