CVE-2026-101145CWE-74CWE-90

CVE-2026-101145

Medium · published September 29, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
12.0
In the wild
Unconfirmed
What it is

A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /callrec/userAddAction.do of the component User Management. Such manipulation of the argument Username leads to ldap injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00221 · 12.0th percentile
Weaknesses
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-90 · Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Published
2026-09-29T01:17Z
References (5)
https://github.com/omarelshopky/cves/tree/main/eleveo/call-recording-software/CVE-2026-101145 · [email protected]https://vuldb.com/cve/CVE-2026-101145 · [email protected]https://vuldb.com/submit/894911 · [email protected]https://vuldb.com/vuln/410997 · [email protected]https://vuldb.com/vuln/410997/cti · [email protected]
EPSS history
Timeline
  • 30 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 28 SEP 20:15Z
    Eleveo Call Recording Software User Management userAddAction.do ldap injection
    cvelistv5