CVE-2026-101145 - Eleveo Call Recording Software User Management userAddAction.do ldap injection

Back Back to CVE browser

MEDIUM

Eleveo Call Recording Software User Management userAddAction.do ldap injection

Published Sep 28, 2026

5.3

MEDIUM

CVSS 4.0

EPSS 0.22%

Description

A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /callrec/userAddAction.do of the component User Management. Such manipulation of the argument Username leads to ldap injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Vendor Eleveo Product Call Recording Software Default
n/a
- Version
  9.7.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Eleveo

Call Recording Software

n/a

Version	Status	Constraints
9.7.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-74

CWE-90

References (6)

https://drive.google.com/file/d/1DZ44Uq3fy7pQYcKwWB4A2gYGFYn1dZSo/view?usp=sharing
exploit
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-88480
Advisory
https://vuldb.com/cve/CVE-2026-101145
third-party-advisory
https://vuldb.com/submit/894911
third-party-advisory
https://vuldb.com/vuln/410997
vdb-entrytechnical-description
https://vuldb.com/vuln/410997/cti
signaturepermissions-required

Link	Providers	Tags
https://drive.google.com/file/d/1DZ44Uq3fy7pQYcKwWB4A2gYGFYn1dZSo/view?usp=sharing		exploit
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-88480		Advisory
https://vuldb.com/cve/CVE-2026-101145		third-party-advisory
https://vuldb.com/submit/894911		third-party-advisory
https://vuldb.com/vuln/410997		vdb-entrytechnical-description
https://vuldb.com/vuln/410997/cti		signaturepermissions-required