Vulnerability · Published Aug 7, 2026 · Assigned by NCSC.ch

CVE-2026-54216TeamDavid: Reflected Cross Site Scripting (XSS) via the 'EntryInfo' parameter

Medium 5.3

In plain English

A medium-severity cross-site scripting in TeamDavid from Tobit Laboratories AG. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.5%top 60.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Tobit Laboratories AG TeamDavid's Webbox application contains a reflected cross-site scripting (XSS) vulnerability. By sending a specially crafted link including an arbitrary path, an XSS payload or the parameter “EntryInfo”, and the parameter “!templateName=entryMail”, an attacker can cause the payload to execute in the victim’s browser when they click the link. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.

Affected products (as reported)

Vendor	Product	Versions
Tobit Laboratories AG	TeamDavid	0 – before Rollout 528

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

References

https://chayns.net/77892-10814/tapp/763210?postId=11454 release-notes
https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/ third-party-advisory