EUVD-2026-70875
GHSA-q48j-cx99-wpm8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low-privilege auth required (PR:L), victim must view injected content (UI:R), scope changes to victim browser (S:C), with low C and I impact typical of XSS.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A flaw has been found in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/roleAddAction.do. Executing a manipulation of the argument name/username can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Stored or reflected cross-site scripting in Eleveo Call Recording Software 9.7.0 allows an authenticated low-privilege user to inject arbitrary client-side script via the name or username parameter of the /callrec/roleAddAction.do endpoint. When a victim user - likely an administrator viewing role management pages - loads the affected page, the injected payload executes in their browser context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privilege authenticated session on the Eleveo Call Recording Software 9.7.0 instance - unauthenticated exploitation is not possible per the CVSS PR:L metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.1 (Medium) accurately reflects limited impact: PR:L confirms a low-privilege authenticated account is required, UI:P confirms passive victim interaction is needed, and VC:N/VI:L/VA:N indicates only integrity impact within the vulnerable system's browser context. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis; the vendor did not respond to disclosure. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Call Recording Software
View allImproper authorization in Eleveo Call Recording Software 9.7.0 allows remote authenticated users to access the /callrec/
Improper authorization in Eleveo Call Recording Software 9.7.0 allows remote authenticated low-privileged users to manip
Improper authorization in Eleveo Call Recording Software 9.7.0 allows remote low-privileged users to manipulate the 'rol
Improper authorization in Eleveo Call Recording Software 9.7.0 exposes the /callrec/sendlogfile endpoint to low-privileg
Improper authorization in Eleveo Call Recording Software 9.7.0 enables remote authenticated attackers to access call rec
Improper authorization in Eleveo Call Recording Software 9.7.0 allows authenticated remote attackers to bypass access co
Improper authorization on the /callrec/pci_dss_status.jsp endpoint in Eleveo Call Recording Software 9.7.0 allows authen
Improper authorization in Eleveo Call Recording Software 9.7.0 allows authenticated remote attackers to access the /call
Improper authorization in Eleveo Call Recording Software 9.7.0 allows low-privileged authenticated remote users to bypas
Improper authorization in Eleveo Call Recording Software 9.7.0 allows authenticated remote attackers to perform unauthor
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today