This vulnerability affects Eleveo Quality Management 9.7.0 and allows remote attackers with low privileges to cause information disclosure via manipulation of an unknown functionality in the specified Scorecard web UI file path. The vulnerability does not require user interaction and has a CVSS 4.0 base score of 5.3 (medium severity). The vendor was contacted but did not respond, and no patch or remediation information is available. The exploit code has been made public, increasing the risk of exploitation.

Successful exploitation results in unauthorized disclosure of information from the affected Eleveo Quality Management system. The vulnerability can be exploited remotely by an attacker with low privileges without user interaction, potentially exposing sensitive data. There is no indication of privilege escalation, denial of service, or integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, organizations should monitor for updates from Eleveo and consider implementing compensating controls such as restricting network access to the affected service and increasing monitoring of related activities.