CVE-2025-66824

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Meeting location field of the Create/Edit Conference functionality in TrueConf Server v5.5.2.10813. The injected payload is stored via the meeting_room parameter and executed when users visit the Conference Info page, allowing attackers to achieve full Account Takeover (ATO). This issue is caused by improper sanitization of user-supplied input in the meeting_room field.

• CWE-79

• https://github.com/x00nullbit/CVE-References/blob/main/CVE-2025-66824/README.mdExploit, Third Party Advisory
• https://trueconf.comProduct
• https://github.com/x00nullbit/CVE-References/blob/main/CVE-2025-66824/README.mdExploit, Third Party Advisory

Published

Dec 30, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-6679The Bit Form builder plugin for WordPress is vulnerable to a…9.8
• CVE-2025-6680The Tutor LMS – eLearning and online course solution plugin …4.3
• CVE-2025-66802Sourcecodester Covid-19 Contact Tracing System 1.0 is vulner…9.8
• CVE-2025-66803Race condition in the turbo-frame element handler in Hotwire…4.8
• CVE-2025-6681The Fan Page plugin for WordPress is vulnerable to Stored Cr…6.4
• CVE-2025-66823An HTML Injection vulnerability in TrueConf server 5.5.2.108…5.4
• CVE-2025-66834A CSV Formula Injection vulnerability in TrueConf Server v5.…7.3
• CVE-2025-66835TrueConf Client 8.5.2 is vulnerable to DLL hijacking via cra…7.1
• CVE-2025-66837A file upload vulnerability in ARIS 10.0.23.0.3587512 allows…6.8
• CVE-2025-66838In Aris v10.0.23.0.3587512 and before, the file upload funct…6.5
• CVE-2025-66843grav before v1.7.49.5 has a Stored Cross-Site Scripting (Sto…5.4
• CVE-2025-66844In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vect…9.1