Threat database

CVE-2026-108809 is a medium severity vulnerability in Eleveo Call Recording Software versions 10.0 through 10.3.0. It involves improper handling of the /auth/realms/default/protocol/openid-connect/logout endpoint, leading to session expiration. The vulnerability can be exploited remotely and requires low privileges with user interaction. The vendor has not responded to disclosure requests, and no patch or official remediation is currently available.

CVE-2026-108808 is a low-severity vulnerability in Eleveo Call Recording Software up to version 10.3.0. It involves the use of the GET request method with sensitive query strings in the JWT Token Handler component, specifically in the /auth/realms/default/protocol/openid-connect/logout endpoint. The vulnerability arises from manipulation of the id_token_hint argument, which may expose sensitive information via query strings. Exploitation is difficult and requires high complexity. The vendor has not responded to disclosure, and no official patch or remediation is currently available.

CVE-2026-101146 is an information disclosure vulnerability in Eleveo Quality Management version 9.7.0. The flaw exists in the UtilsService.createAndSaveAudit function within the GWT RPC Handler component. This vulnerability can be exploited remotely without user interaction and allows attackers to obtain sensitive information. The vendor has not responded to the disclosure, and no patch or remediation is currently available. The vulnerability has a medium severity rating with a CVSS score of 5.3. Public exploit code has been released, increasing the risk of exploitation.

CVE-2026-101145 is an LDAP injection vulnerability in Eleveo Call Recording Software version 9.7.0. It affects the User Management component, specifically the /callrec/userAddAction.do endpoint, where the Username argument can be manipulated to perform LDAP injection. The vulnerability can be exploited remotely without user interaction. No vendor patch or official fix has been provided yet. Public exploit code is available. The CVSS score is 5.3, indicating medium severity.

Eleveo Call Recording Software version 9.7.0 contains a vulnerability in the Query Builder component, specifically in the /callrec/searchAction.do file, that leads to improper access controls. This flaw allows remote attackers to exploit the system without user interaction and with low privileges. The vulnerability has a medium severity rating and a CVSS score of 5.3. The vendor has not responded to disclosure attempts, and no official patch or remediation guidance is currently available.

CVE-2026-101141 is a medium severity cross-site scripting (XSS) vulnerability in Eleveo Call Recording Software version 9.7.0. The flaw exists in the /callrec/audio.jsp file within the Play Audio Page component, where manipulation of the viewRoleId or cfType arguments can lead to XSS. The vulnerability can be exploited remotely and requires low privileges with partial user interaction. The vendor has not responded to the disclosure, and no patch or remediation is currently confirmed.

CVE-2026-85409 is a path traversal vulnerability in Eleveo Quality Management version 9.7.0. It affects the function QuestionnaireService.runDataExportNow, where manipulation of the file_name argument allows an attacker to perform path traversal. The vulnerability can be exploited remotely. Public exploit code is available, but no vendor response or patch has been provided.

CVE-2026-85408 is a medium severity vulnerability in Eleveo Quality Management version 9.7.0. It involves a flaw in the Conversation Handler component where manipulation of the 'createdBy' argument in the /enc-fwk-data/api/v3/conversations/<ID>/events endpoint causes dynamically-determined object attributes. The vulnerability can be exploited remotely without user interaction and requires low privileges. The vendor has not responded to the disclosure, and no patch or fix is currently available.

CVE-2026-85407 is a medium severity denial of service vulnerability in Eleveo Quality Management version 9.7.0. It involves improper processing of the /enc-fwk-data/api/v3/conversations/<ID>/events endpoint in the Conversation Handler component, where manipulation of the argument 'labels' can cause a denial of service. The vulnerability can be exploited remotely without user interaction and requires low privileges. The vendor has not responded to disclosure and no patch information is available. Exploit details have been made public but no known active exploitation is reported.

CVE-2026-85406 is a cross-site scripting (XSS) vulnerability in Eleveo Quality Management version 9.7.0, specifically in the Conversation Review component. This vulnerability allows remote attackers with limited privileges to execute script code via crafted input. The vulnerability has been publicly disclosed, but no vendor response or patch is currently available. The CVSS 4.0 base score is 5.1, indicating a medium severity level.

CVE-2026-85405 is a medium severity cross-site scripting (XSS) vulnerability in Eleveo Call Recording Software version 9.7.0. The flaw exists in the /callrec/roleAddAction.do endpoint where manipulation of the name or username argument can lead to XSS. The vulnerability can be exploited remotely and requires low privileges with user interaction. The vendor has not responded to disclosure and no patch or official fix is currently available.

A security flaw has been discovered in Eleveo Call Recording Software 9.7.0. Impacted is an unknown function of the file /callrec/audio.jsp of the component Call Recording Handler. The manipulation of the argument callId results in improper authorization. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This issue affects some unknown processing of the file /callrec/restoreCallAction.do of the component Recorded Calls Page. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /callrec/composeEmailAction.do. Executing a manipulation can lead to improper authorization. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/pci_dss_status.jsp. Performing a manipulation results in improper authorization. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability has been found in Eleveo Call Recording Software 9.7.0. Affected by this issue is some unknown functionality of the file /callrec/group.jsp. Such manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was determined in Eleveo Call Recording Software 9.7.0. Affected by this vulnerability is an unknown functionality of the file /callrec/sendlogfile. This manipulation causes improper authorization. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.