CVE-2026-85405
Received Received - Intake

Cross-Site Scripting in Eleveo Call Recording Software

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulDB

Description
A flaw has been found in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/roleAddAction.do. Executing a manipulation of the argument name/username can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85405
EUVD
EUVD-2026-70875

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
eleveo call_recording_software 9.7.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cross-site scripting (XSS) flaw in Eleveo Call Recording Software version 9.7.0. It exists in the /callrec/roleAddAction.do file where manipulating the name or username argument can inject malicious scripts. The attack can be executed remotely and an exploit has been publicly disclosed. The vendor did not respond to the disclosure.

Detection Guidance

This vulnerability involves a reflected cross-site scripting (XSS) flaw in Eleveo Call Recording Software 9.7.0 via the /callrec/roleAddAction.do endpoint. To detect it, inspect HTTP requests to this path for unusual parameters like name or username containing script tags or payloads. Check web server logs for suspicious input patterns.

Impact Analysis

This XSS vulnerability could allow attackers to execute malicious scripts in a user's browser when they access the affected Eleveo software. This may lead to session hijacking, theft of sensitive data, or unauthorized actions performed on behalf of the user. The impact depends on user privileges and data accessed.

Compliance Impact

This vulnerability could potentially violate GDPR by exposing personal data through XSS attacks, leading to unauthorized access or data breaches. For HIPAA, if the software handles protected health information, the flaw may compromise confidentiality. Compliance may be impacted if the vulnerability leads to data leaks or unauthorized access.

Mitigation Strategies
  • Update Eleveo Call Recording Software to the latest version if a patch is available.
  • Apply input validation and output encoding to sanitize user-supplied data in the name and username parameters.
  • Implement a web application firewall (WAF) to block XSS payloads targeting the vulnerable endpoint.
  • Restrict access to the /callrec/roleAddAction.do endpoint to trusted IPs if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85405. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart