CVE-2026-101142
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A vulnerability has been found in Eleveo Quality Management 9.7.0. It affects an unknown functionality of the file Scorecard.jsp of the component Questionnaire Audio Upload. The manipulation leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted but did not respond.
Risk Assessment
A remote attacker can exploit path traversal to read arbitrary files on the server, potentially leading to disclosure of sensitive data or further system compromise.
Recommendation
Immediately restrict access to the system, validate file paths, and contact the vendor for a patch.
Other vulnerabilities in Eleveo Quality Management
See all- CVE-2026-101146Medium
A security flaw has been discovered in Eleveo Quality Management 9.7.0. The issue affects the function UtilsService.createAndSaveAudit of the file /qm/cz.zoom.scorecard.webui.Scorecard/QMUtilsService of the component GWT RPC Handler. Manipulation results in information disclosure. The attack can be carried out remotely. The exploit has been publicly released and may be used. The vendor was contacted but did not respond.
- CVE-2026-101143Medium
A vulnerability was found in Eleveo Quality Management 9.7.0. It affects some unknown functionality of the file /qm/cz.zoom.scorecard.webui.Scorecard/cz.zoom.scorecard.webui.Scorecard/QMBODownload. The manipulation results in information disclosure. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted but did not respond.
- CVE-2026-85409Medium
A path traversal vulnerability was identified in Eleveo Quality Management 9.7.0 in the function QuestionnaireService.runDataExportNow of the Questionnaire Service component. Manipulation of the file_name argument leads to path traversal. The attack can be performed remotely. The exploit is publicly available, and the vendor did not respond.
- CVE-2026-85408Medium
A vulnerability was determined in Eleveo Quality Management 9.7.0 in the Conversation Handler component, specifically in the file /enc-fwk-data/api/v3/conversations/<ID>/events. Manipulation of the createdBy argument causes dynamically-determined object attributes. The attack can be performed remotely. The exploit is public, and the vendor did not respond.
- CVE-2026-85407Medium
A vulnerability was found in Eleveo Quality Management 9.7.0 in the Conversation Handler component, specifically in the file /enc-fwk-data/api/v3/conversations/<ID>/events. Manipulation of the labels argument results in denial of service. The attack can be executed remotely. The exploit is public, and the vendor did not respond.
- CVE-2026-85406Low
A vulnerability in Eleveo Quality Management 9.7.0 affects unknown code of the Conversation Review component. Manipulation leads to cross site scripting (XSS). Remote exploitation is possible, and the exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability has been found in Eleveo Quality Management 9.7.0. Affected by this vulnerability is an unknown functionality of the file Scorecard.jsp of the component Questionnaire Audio Upload. The manipulation leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS