CVE-2026-101145

MediumCVSS 4.3/10Last modified Oct 20, 2026

Description

A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /callrec/userAddAction.do of the component User Management. Such manipulation of the argument Username leads to ldap injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-74 CWE-90

Affected software

No affected versions have been published.

Timeline

Published: Sep 28, 2026
Last modified: Oct 20, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1011464.3A security flaw has been discovered in Eleveo Quality Management 9.7.0. This issue affects the function UtilsService.createAndSaveAudit of t CVE-2026-1011478.8The Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Premium WordPress plugin before 8.2.8 do no CVE-2026-10114810.0The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or bl CVE-2026-1011494.1Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary CVE-2026-101154.3A vulnerability was identified in Open5GS up to 2.7.7. This affects an unknown part in the library lib/sbi/nnrf-handler.c of the component S CVE-2026-1011504.1Insufficient validation of OIDC bearer token configuration could allow a user with specific high privileges to direct requests to arbitrary CVE-2026-1011514.3Insufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user,CVE-2026-1011528.0Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clic CVE-2026-1011538.0On affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user CVE-2026-1011547.2An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope thro CVE-2026-1011559.1An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope thro CVE-2026-1011568.4A stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a c