CVE-2026-85405

EUVD-2026-70875
A flaw has been found in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/roleAddAction.do. Executing a manipulation of the argument name/username can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulDBCNA
3.5 LOW
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 8.78%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
eleveocall_recording
9.7.0
CNA
Common Weakness Enumeration
References
https://drive.google.com/file/d/17NWYXc8_i8be0Ndk0txZ7A0hLEtci9xI/view?usp=sharing
https://vuldb.com/cve/CVE-2026-85405
https://vuldb.com/submit/894893
https://vuldb.com/vuln/398555
https://vuldb.com/vuln/398555/cti