CVE-2025-66834
published 2025-12-30CVE-2025-66834: A CSV Formula Injection vulnerability in TrueConf Server v5.5.2.10813 allows a normal user to inject malicious spreadsheet formulas into exported chat logs via…
PriorityP343high7.3CVSS 3.1
AVNACLPRLUIRSUCHIHAN
EPSS
0.31%
21.9th percentile
A CSV Formula Injection vulnerability in TrueConf Server v5.5.2.10813 allows a normal user to inject malicious spreadsheet formulas into exported chat logs via crafted Display Name.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| trueconf | trueconf_server | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
TrueConf Server 5.5.2.10813 Display Name csv injection
vuldb·2026-08-22·CVSS 7.3
CVE-2025-66834 [HIGH] TrueConf Server 5.5.2.10813 Display Name csv injection
A vulnerability categorized as problematic has been discovered in TrueConf Server 5.5.2.10813. Affected by this vulnerability is an unknown functionality of the component Display Name Handler. Executing a manipulation can lead to csv injection.
This vulnerability is registered as CVE-2025-66834. It is possible to launch the attack remotely. No exploit is available.
GHSA
GHSA-5vw2-j3g7-v489: A CSV Formula Injection vulnerability in TrueConf Server v5
ghsa_unreviewed·2025-12-30
CVE-2025-66834 [HIGH] CWE-1236 GHSA-5vw2-j3g7-v489: A CSV Formula Injection vulnerability in TrueConf Server v5
A CSV Formula Injection vulnerability in TrueConf Server v5.5.2.10813 allows a normal user to inject malicious spreadsheet formulas into exported chat logs via crafted Display Name.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-12-30
Published