TrueConf vulnerabilities
We track 9 vulnerabilities in TrueConf products across 4 products. 9 are rated high or critical, and 3 have been exploited in real attacks. The most recent was published on November 11, 2026.
Latest TrueConf vulnerabilities
- 7.8 High severity
TrueConf Server: Incorrect Default Permissions
An attacker who gains the ability to execute arbitrary code on a system with TrueConf Server (Linux) versions from 4.7.2 up to, but not including, 5.5.6 installed, running as the user trueconf (by exploiting some other vulnerability), can elevate their privile
- 9.0 Critical severity
TrueConf Server Code Injection Exploited
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary
- 9.8 Critical severity
TrueConf Server Missing Authentication for Critical Function Exploited
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function.
- 7.8 High severity
TrueConf Client Download of Code Without Integrity Check Exploited
TrueConf Client downloads application update code and applies it without performing verification. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, th
- 7.1 High severity
Trueconf: Uncontrolled Search Path Element
TrueConf Client 8.5.2 is vulnerable to DLL hijacking via crafted wfapi.dll allowing local attackers to execute arbitrary code within the user's context.
- 7.3 High severity
Trueconf Server: Improper Neutralization of Formula Elements in a CSV File
A CSV Formula Injection vulnerability in TrueConf Server v5.5.2.10813 allows a normal user to inject malicious spreadsheet formulas into exported chat logs via crafted Display Name.
- 8.7 High severity
Trueconf Server: Improper Neutralization of Input During Web Page Generation
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Meeting location field of the Create/Edit Conference functionality in TrueConf Server v5.5.2.10813. The injected payload is stored via the meeting_room parameter and executed when users visit the
- 9.8 Critical severity
TrueConf Server: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection issue in the web API in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows remote unauthenticated attackers to execute arbitrary SQL commands, ultimately leading to remote code execution.
- 8.8 High severity
TrueConf Server: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection issue in a database stored function in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows a low-privileged database user to execute arbitrary SQL commands as the database administrator, resulting in execution of arbitrary code.