TrueConf records

17 published records for vendor trueconf.

Researcher profile

Entered KEV: 3 · 17.6%
Weaponized: 3 · 17.6%
Pre-auth RCE: 2
With a fix record: 11.8%
Median publish → KEV: 1 days

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

17 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
69This week	CVE-2026-72530Weaponized	A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X ttrueconf · trueconf server · CWE-94 pre-auth RCE	Critical9.5	KEV	1.7%	Aug 19, 2026
67This week	CVE-2026-72529Weaponized	A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X ttrueconf · trueconf server · CWE-306 Pre-auth Auth bypass	Critical9.3	KEV	1.5%	Aug 19, 2026
61This week	CVE-2026-3502Weaponized	TrueConf Client Update Integrity Verification Bypasstrueconf · trueconf · CWE-494 RCE	High7.8	KEV	0.3%	Mar 30, 2026
40Plan	CVE-2022-46764No exploit	A SQL injection issue in the web API in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows remote unauthenticated attackers to executtrueconf · server · CWE-89 pre-auth RCE SQL injection	Critical9.8	—	2.1%	Dec 26, 2022
35Monitor	CVE-2022-46763No exploit	A SQL injection issue in a database stored function in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows a low-privileged database utrueconf · server · CWE-89 RCE SQL injection	High8.8	—	1.1%	Dec 26, 2022
35Monitor	CVE-2017-20120No exploit	TrueConf Server cross-site request forgerytrueconf · trueconf server · CWE-352 Pre-auth CSRF	High8.8	—	0.5%	Jun 29, 2022
34Monitor	CVE-2025-66824No exploit	A Stored Cross-Site Scripting (XSS) vulnerability exists in the Meeting location field of the Create/Edit Conference functionality in TrueCotrueconf · trueconf server · CWE-79 XSS	High8.7	—	0.3%	Dec 30, 2025
29Monitor	CVE-2025-66834No exploit	A CSV Formula Injection vulnerability in TrueConf Server v5.5.2.10813 allows a normal user to inject malicious spreadsheet formulas into exptrueconf · trueconf server · CWE-1236	High7.3	—	0.3%	Dec 30, 2025
28Monitor	CVE-2025-66835No exploit	TrueConf Client 8.5.2 is vulnerable to DLL hijacking via crafted wfapi.dll allowing local attackers to execute arbitrary code within the usetrueconf · trueconf · CWE-427 RCE	High7.1	—	0.2%	Dec 30, 2025
24Monitor	CVE-2017-20119No exploit	TrueConf Server change-lang redirecttrueconf · server · CWE-601 Pre-auth Open redirect	Medium6.1	—	0.7%	Jun 29, 2022
21Monitor	CVE-2017-20114No exploit	TrueConf Server Reflected cross site scriptingtrueconf · server · CWE-80 XSS	Medium5.4	—	0.6%	Jun 29, 2022
21Monitor	CVE-2017-20113No exploit	TrueConf Server Stored cross site scriptingtrueconf · server · CWE-80 XSS	Medium5.4	—	0.6%	Jun 29, 2022
21Monitor	CVE-2017-20117No exploit	TrueConf Server group DOM cross site scriptingtrueconf · server · CWE-80 XSS	Medium5.4	—	0.6%	Jun 29, 2022
21Monitor	CVE-2017-20118No exploit	TrueConf Server DOM cross site scriptingtrueconf · server · CWE-80 XSS	Medium5.4	—	0.6%	Jun 29, 2022
21Monitor	CVE-2017-20116No exploit	TrueConf Server Reflected cross site scriptingtrueconf · server · CWE-80 XSS	Medium5.4	—	0.6%	Jun 29, 2022
21Monitor	CVE-2017-20115No exploit	TrueConf Server Reflected cross site scriptingtrueconf · server · CWE-80 XSS	Medium5.4	—	0.6%	Jun 29, 2022
21Monitor	CVE-2025-66823No exploit	An HTML Injection vulnerability in TrueConf server 5.5.2.10813 in the conference description field allows an attacker to inject arbitrary HTtrueconf · trueconf server · CWE-79 XSS	Medium5.4	—	0.2%	Dec 30, 2025

CVE-2026-72530
69This week
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X t
CriticalCVSS 9.5KEVWeaponizedEPSS 2%
- pre-auth RCE
trueconf · trueconf serverAug 19, 2026
CVE-2026-72529
67This week
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X t
CriticalCVSS 9.3KEVWeaponizedEPSS 1%
- Pre-auth
- Auth bypass
trueconf · trueconf serverAug 19, 2026
CVE-2026-3502
61This week
TrueConf Client Update Integrity Verification Bypass
HighCVSS 7.8KEVWeaponizedEPSS 0%
- RCE
trueconf · trueconfMar 30, 2026
CVE-2022-46764
40Plan
A SQL injection issue in the web API in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows remote unauthenticated attackers to execut
CriticalCVSS 9.8No exploitEPSS 2%
- pre-auth RCE
- SQL injection
trueconf · serverDec 26, 2022
CVE-2022-46763
35Monitor
A SQL injection issue in a database stored function in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows a low-privileged database u
HighCVSS 8.8No exploitEPSS 1%
- RCE
- SQL injection
trueconf · serverDec 26, 2022
CVE-2017-20120
35Monitor
TrueConf Server cross-site request forgery
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
trueconf · trueconf serverJun 29, 2022
CVE-2025-66824
34Monitor
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Meeting location field of the Create/Edit Conference functionality in TrueCo
HighCVSS 8.7No exploitEPSS 0%
- XSS
trueconf · trueconf serverDec 30, 2025
CVE-2025-66834
29Monitor
A CSV Formula Injection vulnerability in TrueConf Server v5.5.2.10813 allows a normal user to inject malicious spreadsheet formulas into exp
HighCVSS 7.3No exploitEPSS 0%
trueconf · trueconf serverDec 30, 2025
CVE-2025-66835
28Monitor
TrueConf Client 8.5.2 is vulnerable to DLL hijacking via crafted wfapi.dll allowing local attackers to execute arbitrary code within the use
HighCVSS 7.1No exploitEPSS 0%
- RCE
trueconf · trueconfDec 30, 2025
CVE-2017-20119
24Monitor
TrueConf Server change-lang redirect
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- Open redirect
trueconf · serverJun 29, 2022
CVE-2017-20114
21Monitor
TrueConf Server Reflected cross site scripting
MediumCVSS 5.4No exploitEPSS 1%
- XSS
trueconf · serverJun 29, 2022
CVE-2017-20113
21Monitor
TrueConf Server Stored cross site scripting
MediumCVSS 5.4No exploitEPSS 1%
- XSS
trueconf · serverJun 29, 2022
CVE-2017-20117
21Monitor
TrueConf Server group DOM cross site scripting
MediumCVSS 5.4No exploitEPSS 1%
- XSS
trueconf · serverJun 29, 2022
CVE-2017-20118
21Monitor
TrueConf Server DOM cross site scripting
MediumCVSS 5.4No exploitEPSS 1%
- XSS
trueconf · serverJun 29, 2022
CVE-2017-20116
21Monitor
TrueConf Server Reflected cross site scripting
MediumCVSS 5.4No exploitEPSS 1%
- XSS
trueconf · serverJun 29, 2022
CVE-2017-20115
21Monitor
TrueConf Server Reflected cross site scripting
MediumCVSS 5.4No exploitEPSS 1%
- XSS
trueconf · serverJun 29, 2022
CVE-2025-66823
21Monitor
An HTML Injection vulnerability in TrueConf server 5.5.2.10813 in the conference description field allows an attacker to inject arbitrary HT
MediumCVSS 5.4No exploitEPSS 0%
- XSS
trueconf · trueconf serverDec 30, 2025