CVE-2025-66823: n/a
Source CVE Database V5
Not known to be exploited · CVSS 3.5 Low.
Data as of 26 Oct 2026, 08:30 UTC
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 8% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 30 Dec 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate CVE-2025-66823, European organizations should first verify if they are running TrueConf server version 5.5.2.10813 or earlier and monitor vendor communications for official patches or updates. In the absence of a patch, organizations should restrict conference creation and editing privileges to trusted users only, minimizing the number of accounts that can inject HTML content. Implement strict input validation and output encoding on the conference description field to neutralize HTML tags and attributes, preventing injection. Additionally, educate users to be cautious when viewing conference info pages, especially if unexpected content appears. Network segmentation and access controls can limit exposure of the TrueConf server to internal trusted networks only. Regularly audit conference descriptions for suspicious content and monitor logs for unusual editing activity. Employ web application firewalls (WAFs) with custom rules to detect and block HTML injection attempts targeting the conference description field. Finally, incorporate this vulnerability into security awareness training to reduce the risk of social engineering attacks leveraging injected content.
Description
An HTML Injection vulnerability in TrueConf server 5.5.2.10813 in the conference description field allows an attacker to inject arbitrary HTML in the Create/Edit conference functionality. The payload will be triggered when the victim opens the Conference Info page ([conference url]/info).