Trueconf Server
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Trueconf Server.
Known Exploited Trueconf Server Vulnerabilities
The following Trueconf Server vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| TrueConf Server Code Injection Vulnerability |
TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system. CVE-2026-72530 |
August 20, 2026 |
| TrueConf Server Missing Authentication for Critical Function Vulnerability |
TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script. CVE-2026-72529 |
August 20, 2026 |
By the Year
In 2026 there have been 2 vulnerabilities in Trueconf Server with an average score of 9.4 out of ten. Last year, in 2025 Server had 1 security vulnerability published. That is, 1 more vulnerability have already been reported in 2026 as compared to last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 2 | 9.40 |
| 2025 | 1 | 0.00 |
| 2024 | 0 | 0.00 |
| 2023 | 0 | 0.00 |
| 2022 | 10 | 6.59 |
It may take a day or so for new Server vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Trueconf Server Security Vulnerabilities
TrueConf Server 5.3-5.5 RCE via Port 4307 (Isolated Env Bypass)
CVE-2026-72530
9 - Critical
- August 19, 2026
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.
Code Injection
Arbitrary Script Exec via Undocumented Func on TrueConf Serv <5.5.5
CVE-2026-72529
9.8 - Critical
- August 19, 2026
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function.
Missing Authentication for Critical Function
ColoradoFTP Server 1.3 Bld8: Unauth Dir Traversal in GET/PUT
CVE-2025-34110
- July 15, 2025
A directory traversal vulnerability exists in ColoradoFTP Server 1.3 Build 8 for Windows, allowing unauthenticated attackers to read or write arbitrary files outside the configured FTP root directory. The flaw is due to insufficient sanitation of user-supplied file paths in the FTP GET and PUT command handlers. Exploitation is possible by submitting traversal sequences during FTP operations, enabling access to system-sensitive files. This issue affects only the Windows version of ColoradoFTP.
Directory traversal
TrueConf Server 5.2.0.10225 RCE via SQL Injection in Web API
CVE-2022-46764
9.8 - Critical
- December 27, 2022
A SQL injection issue in the web API in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows remote unauthenticated attackers to execute arbitrary SQL commands, ultimately leading to remote code execution.
SQL Injection
TrueConf Server 5.2.0.10225 SQLi in stored function
CVE-2022-46763
8.8 - High
- December 27, 2022
A SQL injection issue in a database stored function in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows a low-privileged database user to execute arbitrary SQL commands as the database administrator, resulting in execution of arbitrary code.
SQL Injection
A vulnerability classified as problematic was found in TrueConf Server 4.3.7
CVE-2017-20120
8.8 - High
- June 29, 2022
A vulnerability classified as problematic was found in TrueConf Server 4.3.7. This vulnerability affects unknown code of the file /admin/service/stop/. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Session Riding
A vulnerability classified as problematic has been found in TrueConf Server 4.3.7
CVE-2017-20119
6.1 - Medium
- June 29, 2022
A vulnerability classified as problematic has been found in TrueConf Server 4.3.7. This affects an unknown part of the file /admin/general/change-lang. The manipulation of the argument redirect_url leads to open redirect. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Open Redirect
A vulnerability was found in TrueConf Server 4.3.7
CVE-2017-20118
5.4 - Medium
- June 29, 2022
A vulnerability was found in TrueConf Server 4.3.7. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/conferences/list/. The manipulation of the argument domxss leads to basic cross site scripting (DOM). The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
XSS
A vulnerability was found in TrueConf Server 4.3.7
CVE-2017-20117
5.4 - Medium
- June 29, 2022
A vulnerability was found in TrueConf Server 4.3.7. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/group. The manipulation leads to basic cross site scripting (DOM). The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
XSS
A vulnerability was found in TrueConf Server 4.3.7
CVE-2017-20116
5.4 - Medium
- June 29, 2022
A vulnerability was found in TrueConf Server 4.3.7. It has been classified as problematic. Affected is an unknown function of the file /admin/group/list/. The manipulation of the argument checked_group_id leads to basic cross site scripting (Reflected). It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
XSS
A vulnerability was found in TrueConf Server 4.3.7 and classified as problematic
CVE-2017-20115
5.4 - Medium
- June 29, 2022
A vulnerability was found in TrueConf Server 4.3.7 and classified as problematic. This issue affects some unknown processing of the file /admin/conferences/list/. The manipulation of the argument sort leads to basic cross site scripting (Reflected). The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
XSS
A vulnerability has been found in TrueConf Server 4.3.7 and classified as problematic
CVE-2017-20114
5.4 - Medium
- June 29, 2022
A vulnerability has been found in TrueConf Server 4.3.7 and classified as problematic. This vulnerability affects unknown code of the file /admin/conferences/get-all-status/. The manipulation of the argument keys[] leads to basic cross site scripting (Reflected). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
XSS
A vulnerability, which was classified as problematic, was found in TrueConf Server 4.3.7
CVE-2017-20113
5.4 - Medium
- June 29, 2022
A vulnerability, which was classified as problematic, was found in TrueConf Server 4.3.7. This affects an unknown part. The manipulation leads to basic cross site scripting (Stored). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
XSS
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Trueconf Server or by Trueconf? Click the Watch button to subscribe.
