Description
A flaw has been found in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/roleAddAction.do. Executing a manipulation of the argument name/username can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-04
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability is an instance of uncontrolled script injection via the name/username field in the /callrec/roleAddAction.do endpoint. Altering that argument causes the software to render malicious JavaScript in the browser of any user who views the affected response. The flaw can lead to session hijacking, defacement, or further web-based attacks, compromising confidentiality and integrity of user data.

Affected Systems

Eleveo Call Recording Software version 9.7.0 is explicitly affected. No other versions are listed, so only installations of 9.7.0 or earlier that have not been patched should be considered vulnerable.

Risk and Exploitability

The CVSS base score of 5.1 indicates a moderate impact and the EPSS data is unavailable, yet the exploit has been published and is documented as usable. The absence from the KEV catalog does not negate the risk. Attackers can trigger the flaw remotely by sending a crafted HTTP request to the vulnerable endpoint, exploiting the XSS to steal session cookies or inject further payloads.

Generated by OpenCVE AI on September 4, 2026 at 04:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Identify all instances of Eleveo Call Recording Software 9.7.0 or earlier that expose the /callrec/roleAddAction.do endpoint.
  • Apply a vendor-supplied patch or upgrade to a released version that has the XSS fix. If no patch is available, restrict access to the endpoint through a web‑application firewall or block the request before it reaches the application.
  • Enforce strict input validation on the name/username parameter, ensuring scripts are stripped or encoded before rendering.
  • Configure the web server or application to use a Content-Security-Policy that disallows inline scripts, reducing the impact of any remaining XSS vectors.

Generated by OpenCVE AI on September 4, 2026 at 04:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 04 Sep 2026 03:45:00 +0000

Type Values Removed Values Added
Description A flaw has been found in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/roleAddAction.do. Executing a manipulation of the argument name/username can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Eleveo Call Recording Software roleAddAction.do cross site scripting
First Time appeared Eleveo
Eleveo call Recording Software
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:eleveo:call_recording_software:*:*:*:*:*:*:*:*
Vendors & Products Eleveo
Eleveo call Recording Software
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Eleveo Call Recording Software
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-04T03:30:09.315Z

Reserved: 2026-09-03T18:44:53.764Z

Link: CVE-2026-85405

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-04T04:18:08.410

Modified: 2026-09-04T04:18:08.410

Link: CVE-2026-85405

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-04T04:30:13Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')