240 matches found
CVE-2026-72530: Improper Control of Generation of Code
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system...
CVE-2026-72529: Missing Authentication for Critical Function
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function...
VulnCheck KEV: CVE-2026-72530
TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system...
VulnCheck KEV: CVE-2026-72529
TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script...
Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference participants
Overview of the attack In July 2026, Kaspersky experts detected a new attack by the Head Mare group. Previously, we classified them as hacktivists, but now we define them as an APT group due to the sophistication of their TTPs and the absence of destructive activity encryption, wiping in the...
TrueConf Server Flaws Exploited to Replace Client Installers with PhantomCore
The threat actor known as Head Mare has been observed weaponizing security flaws in unpatched TrueConf servers once again in attacks targeting Russian companies spanning instrumentation, electronics, transport, energy, IT, and software development sectors. Russian cybersecurity vendor Kaspersky...
The vulnerability of the TrueConf Server software, related to improper code generation management, allows a perpetrator to execute arbitrary code.
The vulnerability of the TrueConf Server software is related to incorrect code generation management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability of the TrueConf Server software lies in the lack of authentication for critical functions, allowing attackers to execute arbitrary scripts and increase their privileges.
The vulnerability of the TrueConf Server software is related to the lack of authentication for critical functions. Exploiting this vulnerability allows a malicious actor to execute arbitrary scripts and increase their privileges...
PT-2026-70005
Name of the Vulnerable Software and Affected Versions TrueConf Server versions 5.3.x through 5.3.9 TrueConf Server versions 5.4.x through 5.4.9 TrueConf Server versions 5.5.x through 5.5.5 TrueConf Server versions prior to 5.5.5 Description An issue exists where a remote unauthorized attacker wit...
PT-2026-70006
Name of the Vulnerable Software and Affected Versions TrueConf server versions 5.3.0 through 5.3.9 TrueConf server versions 5.4.0 through 5.4.9 TrueConf server versions 5.5.0 through 5.5.5 TrueConf server versions prior to 5.3.0 Description Improper management of code generation allows a remote...
TrueConf Windows Client < 8.5.3.884 Download of Code Without Integrity Check Vulnerability (CVE-2026-3502)
The version of TrueConf Windows Client installed on the remote host is prior to 8.5.3.884. It is, therefore, affected by a vulnerability: â A remote code execution vulnerability exists in the TrueConf Client update mechanism due to lack of cryptographic verification of update packages. An...
PhantomCore Exploits TrueConf Vulnerabilities to Breach Russian Networks
A pro-Ukrainian hacktivist group called PhantomCore has been attributed to attacks actively targeting servers running TrueConf video conferencing software in Russia since September 2025. That's according to a report published by Positive Technologies, which found the threat actors to be leveragin...
The vulnerability of the Create/Edit Conference function in the TrueConf Server software allows a hacker to execute arbitrary code.
The vulnerability of the “Create/Edit Conference” function in the TrueConf Server software is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely, provided that the user opens a specially...
The vulnerability of the Create/Edit Conference function in the TrueConf Server software allows a hacker to gain access to authentication data.
The vulnerability of the “Create/Edit Conference” function in the TrueConf Server software is related to the lack of measures taken to protect the structure of the web page during the processing of the “meetingRoom” parameter. Exploiting this vulnerability can allow a malicious actor, operating...
The vulnerability of the TrueConf Server software lies in the lack of mechanisms to neutralize elements related to CSV files, allowing attackers to gain access and modify any arbitrary files.
The vulnerability of the TrueConf Server software is related to the lack of mechanisms for neutralizing elements in CSV files. Exploiting this vulnerability allows a malicious actor to gain access and modify any file at will...
The vulnerability of the TrueConf Client software lies in its uncontrolled search path, which allows a hacker to execute arbitrary code.
The vulnerability of the TrueConf Client software is related to an uncontrolled element in the search process. Exploiting this vulnerability allows a perpetrator to execute arbitrary code by introducing a specially crafted DLL file...
Exploit for Download of Code Without Integrity Check in Trueconf
🔍 CVE-2026-3502 Scanner - TrueConf Vulnerability Detection Too...
Exploit for Download of Code Without Integrity Check in Trueconf
🔓 CVE-2026-3502 - TrueConf Client Update Hijacking Exploit !...
The vulnerability of the application software interface of TrueConf Server allows a perpetrator to execute arbitrary code.
The vulnerability of the application software interface of TrueConf Server is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
The vulnerability of the TrueConf Client software lies in the fact that code can be loaded without checking its integrity, allowing an attacker to execute arbitrary code.
The vulnerability of the TrueConf Client software lies in the fact that the code is loaded without any checks for its integrity. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by introducing a specially crafted DLL file...