CVE-2026-54216 is a reflected cross-site scripting (CWE-79) vulnerability in Tobit Laboratories AG TeamDavid's Webbox application. By sending a specially crafted URL containing an arbitrary path, an XSS payload or the parameter “EntryInfo”, and the parameter “!templateName=entryMail”, an attacker can cause the payload to execute in the victim's browser when the link is clicked. This vulnerability affects TeamDavid through Rollout 524. No patch or official remediation information is currently available.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser session, potentially leading to session hijacking, information disclosure, or other client-side impacts. The vulnerability requires user interaction (clicking the malicious link) and has low vector complexity and privileges required, but limited scope and impact as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about clicking suspicious links containing the specified parameters. No official remediation or temporary fix has been documented at this time.