This vulnerability in Eleveo Call Recording Software 9.7.0 involves improper sanitization of input parameters (viewRoleId/cfType) in the /callrec/audio.jsp file, allowing an attacker to execute cross-site scripting attacks remotely. The CVSS 4.0 score is 5.1 (medium severity), reflecting network attack vector, low attack complexity, and required user interaction. Exploit code has been published, but no known active exploitation in the wild has been reported. The vendor has not provided any response or patch information.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, information disclosure, or other client-side impacts. The attack requires low privileges and user interaction but can be launched remotely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider applying input validation or web application firewall rules to block malicious input targeting the viewRoleId and cfType parameters as a temporary mitigation.