CVE-2026-108809

A vulnerability in Eleveo Call Recording Software up to 10.3.0 affects unknown code in the /auth/realms/default/protocol/openid-connect/logout file of the JWT Token Handler component. Manipulating the id_token_hint argument can lead to the use of the GET request method with sensitive query strings. The attack can be launched remotely but is difficult to exploit.

A vulnerability was identified in Eleveo Call Recording Software 9.7.0. It affects unknown code of the file /callrec/userAddAction.do of the component User Management. Manipulation of the argument Username leads to LDAP injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted but did not respond.

A vulnerability was determined in Eleveo Call Recording Software 9.7.0. It affects an unknown part of the file /callrec/searchAction.do of the component Query Builder. This manipulation causes improper access controls. Remote exploitation is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted but did not respond.

A flaw was found in Eleveo Call Recording Software 9.7.0 in an unknown function of the file /callrec/audio.jsp in the Play Audio Page component. Manipulating the viewRoleId/cfType arguments leads to cross-site scripting, and the attack can be launched remotely. The exploit has been published and may be used; the vendor did not respond.

A vulnerability in Eleveo Call Recording Software 9.7.0 affects an unknown part of the file /callrec/roleAddAction.do. Manipulation of the argument name/username leads to cross site scripting (XSS). The attack may be launched remotely, and the exploit has been published.

An improper authorization vulnerability has been discovered in Eleveo Call Recording Software 9.7.0. The unknown function in the /callrec/audio.jsp file fails to properly validate permissions for the callId parameter, allowing unauthorized access. The attack can be performed remotely and the exploit is publicly available.

A vulnerability was found in Eleveo Call Recording Software 9.7.0 in the file /callrec/composeEmailAction.do. Unknown code allows remote manipulation leading to improper authorization. The exploit has been publicly disclosed and may be used.

A vulnerability in Eleveo Call Recording Software 9.7.0 was found in the /callrec/pci_dss_status.jsp file, allowing unauthorized access. The attack can be performed remotely and the exploit has been made public. The vendor did not respond to the disclosure.

A vulnerability was found in Eleveo Call Recording Software 9.7.0 in the file /callrec/group.jsp. An unknown functionality leads to improper authorization, which can be exploited remotely. The exploit has been publicly disclosed and may be used.

A vulnerability was found in Eleveo Call Recording Software 9.7.0 in the file /callrec/sendlogfile. An unknown functionality causes improper authorization, allowing remote attacks. The exploit has been publicly disclosed and may be used.