CVE-2026-54216

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54216", "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c", "state": "PUBLISHED", "assignerShortName": "NCSC.ch", "dateReserved": "2026-06-12T09:32:46.514Z", "datePublished": "2026-08-07T09:48:46.402Z", "dateUpdated": "2026-09-07T13:02:09.991Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "455daabc-a392-441d-aa46-37d35189897c", "shortName": "NCSC.ch", "dateUpdated": "2026-09-07T13:02:09.991Z"}, "title": "TeamDavid: Reflected Cross Site Scripting (XSS) via the 'EntryInfo' parameter", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')", "type": "CWE"}]}], "affected": [{"vendor": "Tobit Laboratories AG", "product": "TeamDavid", "modules": ["Webbox"], "versions": [{"status": "affected", "version": "0", "lessThan": "Rollout 528", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Tobit Laboratories AG TeamDavid's Webbox application contains a reflected cross-site scripting (XSS) \nvulnerability. By sending a specially crafted link including an \narbitrary path, an XSS payload or the parameter \u201cEntryInfo\u201d, and the \nparameter \u201c!templateName=entryMail\u201d, an attacker can cause the payload \nto execute in the victim\u2019s browser when they click the link.\u00a0This issue affects TeamDavid before Rollout 528.\n\nStarting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Tobit Laboratories AG TeamDavid's Webbox application contains a reflected cross-site scripting (XSS) \nvulnerability. By sending a specially crafted link including an \narbitrary path, an XSS payload or the parameter \u201cEntryInfo\u201d, and the \nparameter \u201c!templateName=entryMail\u201d, an attacker can cause the payload \nto execute in the victim\u2019s browser when they click the link.&nbsp;<div><div><span>This issue affects TeamDavid before Rollout 528.</span></div><div><span>Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.</span></div></div>"}]}], "references": [{"url": "https://chayns.net/77892-10814/tapp/763210?postId=11454", "tags": ["release-notes"]}, {"url": "https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/", "tags": ["third-party-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"}}], "credits": [{"lang": "en", "value": "Dario Weiss of InfoGuard Labs", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"references": [{"url": "https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-07T11:24:10.712764Z", "id": "CVE-2026-54216", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T11:24:31.038Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54216", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-07T11:24:10.712764Z"}}}], "references": [{"url": "https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T11:24:23.089Z"}}], "cna": {"title": "TeamDavid: Reflected Cross Site Scripting (XSS) via the 'EntryInfo' parameter", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Dario Weiss of InfoGuard Labs"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Tobit Laboratories AG", "modules": ["Webbox"], "product": "TeamDavid", "versions": [{"status": "affected", "version": "0", "lessThan": "Rollout 528", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://chayns.net/77892-10814/tapp/763210?postId=11454", "tags": ["release-notes"]}, {"url": "https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "Tobit Laboratories AG TeamDavid's Webbox application contains a reflected cross-site scripting (XSS) \nvulnerability. By sending a specially crafted link including an \narbitrary path, an XSS payload or the parameter \u201cEntryInfo\u201d, and the \nparameter \u201c!templateName=entryMail\u201d, an attacker can cause the payload \nto execute in the victim\u2019s browser when they click the link.\u00a0This issue affects TeamDavid before Rollout 528.\n\nStarting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.", "supportingMedia": [{"type": "text/html", "value": "Tobit Laboratories AG TeamDavid's Webbox application contains a reflected cross-site scripting (XSS) \nvulnerability. By sending a specially crafted link including an \narbitrary path, an XSS payload or the parameter \u201cEntryInfo\u201d, and the \nparameter \u201c!templateName=entryMail\u201d, an attacker can cause the payload \nto execute in the victim\u2019s browser when they click the link.&nbsp;<div><div><span>This issue affects TeamDavid before Rollout 528.</span></div><div><span>Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.</span></div></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')"}]}], "providerMetadata": {"orgId": "455daabc-a392-441d-aa46-37d35189897c", "shortName": "NCSC.ch", "dateUpdated": "2026-09-07T13:02:09.991Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54216", "state": "PUBLISHED", "dateUpdated": "2026-09-07T13:02:09.991Z", "dateReserved": "2026-06-12T09:32:46.514Z", "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c", "datePublished": "2026-08-07T09:48:46.402Z", "assignerShortName": "NCSC.ch"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["Webbox"], "product": "TeamDavid", "vendor": "Tobit Laboratories AG", "versions": [{"lessThan": "Rollout 528", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "vulnerability@ncsc.ch"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Tobit Laboratories AG TeamDavid's Webbox application contains a reflected cross-site scripting (XSS) \nvulnerability. By sending a specially crafted link including an \narbitrary path, an XSS payload or the parameter \u201cEntryInfo\u201d, and the \nparameter \u201c!templateName=entryMail\u201d, an attacker can cause the payload \nto execute in the victim\u2019s browser when they click the link.\u00a0This issue affects TeamDavid before Rollout 528.\n\nStarting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality."}, {"lang": "es", "value": "La aplicaci\u00f3n Webbox de TeamDavid de Tobit Laboratories AG contiene una vulnerabilidad de cross-site scripting (XSS) reflejado. Al enviar un enlace especialmente dise\u00f1ado que incluya una ruta arbitraria, una carga \u00fatil XSS o el par\u00e1metro \u2019EntryInfo\u2019, y el par\u00e1metro \u2019!templateName=entryMail\u2019, un atacante puede hacer que la carga \u00fatil se ejecute en el navegador de la v\u00edctima cuando hagan clic en el enlace. Este problema afecta a TeamDavid hasta el Rollout 524."}], "id": "CVE-2026-54216", "lastModified": "2026-10-24T16:10:00.153", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "vulnerability@ncsc.ch", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54216", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-07T11:24:10.712764Z", "version": "2.0.3"}}]}, "published": "2026-08-07T10:16:58.893", "references": [{"source": "vulnerability@ncsc.ch", "url": "https://chayns.net/77892-10814/tapp/763210?postId=11454"}, {"source": "vulnerability@ncsc.ch", "url": "https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/"}], "sourceIdentifier": "vulnerability@ncsc.ch", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "vulnerability@ncsc.ch", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,Rollout 524]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "TeamDavid", "source": "cna", "vendor": "Tobit Laboratories AG"}, "product": "teamdavid", "vendor": "tobit_laboratories_ag"}], "created": "2026-08-07T11:20:00.127052+00:00", "updated": "2026-09-07T15:45:17.435176+00:00", "vendors": ["tobit_laboratories_ag", "tobit_laboratories_ag$PRODUCT$teamdavid"]}