CVE-2026-101143

MediumCVSS 4.3/10Last modified Oct 20, 2026

Description

A vulnerability was found in Eleveo Quality Management 9.7.0. Affected by this issue is some unknown functionality of the file /qm/cz.zoom.scorecard.webui.Scorecard/cz.zoom.scorecard.webui.Scorecard/QMBODownload. The manipulation results in information disclosure. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200 CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Sep 28, 2026
Last modified: Oct 20, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1011446.3A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/searchAction.do of CVE-2026-1011454.3A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /callrec/userAdd CVE-2026-1011464.3A security flaw has been discovered in Eleveo Quality Management 9.7.0. This issue affects the function UtilsService.createAndSaveAudit of t CVE-2026-1011478.8The Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Premium WordPress plugin before 8.2.8 do no CVE-2026-10114810.0The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or bl CVE-2026-1011494.1Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary CVE-2026-101154.3A vulnerability was identified in Open5GS up to 2.7.7. This affects an unknown part in the library lib/sbi/nnrf-handler.c of the component S CVE-2026-1011504.1Insufficient validation of OIDC bearer token configuration could allow a user with specific high privileges to direct requests to arbitrary CVE-2026-1011514.3Insufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user,CVE-2026-1011528.0Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clic CVE-2026-1011538.0On affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user CVE-2026-1011547.2An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope thro