Eleveo Call Recording Software User Management userAddAction.do ldap injection
Summary
| CVE | CVE-2026-101145 |
|---|---|
| State | PUBLISHED |
| Assigner | VulDB |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-28 21:17:12 UTC |
| Updated | 2026-10-20 23:16:53 UTC |
| Description | A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /callrec/userAddAction.do of the component User Management. Such manipulation of the argument Username leads to ldap injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. |
Risk And Classification
Primary CVSS: v4.0 2.1 LOW from [email protected]
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.002210000 probability, percentile 0.119270000 (date 2026-10-20)
Problem Types: CWE-74 | CWE-90 | CWE-90 LDAP Injection | CWE-74 Injection
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 2.1 | LOW | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/C... |
| 4.0 | CNA | DECLARED | 5.3 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P |
| 3.1 | [email protected] | Secondary | 4.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| 3.1 | CNA | DECLARED | 4.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R |
| 3.0 | CNA | DECLARED | 4.3 | MEDIUM | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R |
| 2.0 | [email protected] | Secondary | 4 | AV:N/AC:L/Au:S/C:P/I:N/A:N | |
| 2.0 | CNA | DECLARED | 4 | AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v3.0 Breakdown
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Eleveo | Call Recording Software | affected 9.7.0 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| vuldb.com/cve/CVE-2026-101145 | [email protected] | vuldb.com | |
| vuldb.com/submit/894911 | [email protected] | vuldb.com | |
| vuldb.com/vuln/410997/cti | [email protected] | vuldb.com | |
| vuldb.com/vuln/410997 | [email protected] | vuldb.com | |
| github.com/omarelshopky/cves/tree/main/eleveo/call-recording-software/CV... | [email protected] | github.com | |
| drive.google.com/file/d/1DZ44Uq3fy7pQYcKwWB4A2gYGFYn1dZSo/view | MITRE | drive.google.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Omar Elshopky (Spark Professional Services) (en)
CNA: omarelshopky (VulDB User) (en)
CNA: omarelshopky (VulDB User) (en)
CNA: VulDB CNA Team (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-03-10T00:00:00.000Z | Vendor informed |
| CNA | 2026-09-28T00:00:00.000Z | Advisory disclosed |
| CNA | 2026-09-28T02:00:00.000Z | VulDB entry created |
| CNA | 2026-10-21T00:49:14.000Z | VulDB entry last update |