CVE-2026-54199

Tobit Laboratories AG TeamDavid's Webbox  is vulnerable to HTTP header injection through the 
request body in the application's link storing functionality 
(//ServerClient_celink.htm), which is appended to the redirect target in
 the 302 HTTP response. If a line feed is added, this will also be added
 to the redirect link, resulting in the ability to control the response 
headers. This issue affects TeamDavid through Rollout 524.