The vulnerability of the TrueConf Server software, related to deficiencies in the authentication process, allows a perpetrator to obtain a token with administrator privileges.

The vulnerability of the TrueConf Server software is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to obtain an administrator-level token...

CVE-2023-42793

CVE-2023-42793 - Create username administrator Example of command execution: root@kitploit: python3 exploit.py -u http://localhost User add token - eyJ0eXAiOiAiVENWMiJ9.YkZ0V2tzR3NvWXhZelRfZTN0cFF1SkZjVWVz.N2M0Njk2ZTgtNWZhYi00MTU5LWJmZjQtYWU1MDFlYzZiMGY1 Successful execution, preparing for the RC...

CVE-2026-3502-Scanner---TrueConf-Vulnerability-Detection-Tool

🔍 CVE-2026-3502 扫描器 - TrueConf 漏洞检测工具 ⚠️ 警告 仅用于教育目的和授权测试。 📋 描述 用于 CVE-2026-3502 的检测工具。扫描未验证更新的 TrueConf 服务器，检测易受攻击的 Windows 客户端（≤8.5.3.884），并搜索 TrueChaos 的 IOC：PowerISO、注册表持久化和计划任务。 📦 安装 root@kitploit: git clone https://github.com/tu-usuario/CVE-2026-3502-Scanner.git cd CVE-2026-3502-Scanner pip...

CVE-2026-3502---TrueConf-Client-Update-Hijacking-PoC

🔓 CVE-2026-3502 - TrueConf Client Update Hijacking Exploit ⚠️ ADVERTENCIA Esta herramienta es solo para fines educativos y de pruebas autorizadas. No utilizar en sistemas sin permiso explícito. 📋 Descripción Exploit para CVE-2026-3502 - vulnerabilidad de actualización sin verificación de...

CVE-2026-72530-TrueConf-Sandbox-Escape-

CVE-2026-72530: TrueConf Server Sandbox Escape - Mitigation & Detection PoC 📌 General Description This repository contains an educational demonstration of mitigation and detection for CVE-2026-72530 , a critical Code Injection and Sandbox Escape vulnerability in TrueConf Server. Vulnerability...

TrueConf Server Missing Authentication for Critical Function Vulnerability

TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script...

TrueConf Server Code Injection Vulnerability

TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system...

CVE-2026-72530

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system...

CVE-2026-72529

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function...

EUVD-2026-62588

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system...

CVE-2026-72530

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system...

CVE-2026-72530

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system...

CVE-2026-72530

TrueConf Server (versions 5.3.X–5.3.9, 5.4.X–5.4.9, 5.5.X–5.5.5, and earlier) is vulnerable to a sandbox escape via improper code generation management. A remote unauthenticated attacker with network access to port 4307/TCP (open by default) can deliver a specially crafted script that breaks out ...

CVE-2026-72529

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function...

EUVD-2026-62587

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function...

CVE-2026-72529

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function...

CVE-2026-72529

TrueConf Server (videoconferencing) is affected by a missing authentication vulnerability in an undocumented function accessible via port 4307/TCP . A remote unauthenticated attacker can invoke this function to execute an arbitrary script on the server. Affected versions: 5.3.X–5.3.9, 5.4.X–5.4.9...

VulnCheck KEV: CVE-2026-72530

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system...

VulnCheck KEV: CVE-2026-72529

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function...

Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference participants

Overview of the attack In July 2026, Kaspersky experts detected a new attack by the Head Mare group. Previously, we classified them as hacktivists, but now we define them as an APT group due to the sophistication of their TTPs and the absence of destructive activity encryption, wiping in the...