CVE-2026-54216 is a reflected cross-site scripting (XSS) vulnerability in Tobit Laboratories AG TeamDavid's Webbox application. The vulnerability is triggered by sending a specially crafted URL containing an arbitrary path, an XSS payload or the parameter 'EntryInfo', and the parameter '!templateName=entryMail'. When a victim clicks this link, the payload executes in their browser, potentially allowing script-based attacks. The affected versions include TeamDavid through Rollout 524. There is no information about an available patch or fix at this time.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser session when they click a malicious link. This can lead to session hijacking, information disclosure, or other script-based attacks limited by the browser context. There are no known exploits in the wild reported. The vulnerability requires user interaction (clicking the crafted link).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about clicking suspicious links. No official fix or temporary workaround has been documented.