CVE-2026-85406
LowCVSS 3.5Summary
A vulnerability in Eleveo Quality Management 9.7.0 affects unknown code of the Conversation Review component. Manipulation leads to cross site scripting (XSS). Remote exploitation is possible, and the exploit has been publicly disclosed.
Risk Assessment
The risk involves the possibility of remote script execution in the context of a user's browser, which could lead to session theft, account takeover, or other attacks on system users.
Recommendation
It is recommended to apply available patches or workarounds immediately, and to restrict access to the Conversation Review component to trusted users.
Other vulnerabilities in Eleveo Quality Management
See all- CVE-2026-85409Medium
A path traversal vulnerability was identified in Eleveo Quality Management 9.7.0 in the function QuestionnaireService.runDataExportNow of the Questionnaire Service component. Manipulation of the file_name argument leads to path traversal. The attack can be performed remotely. The exploit is publicly available, and the vendor did not respond.
- CVE-2026-85408Medium
A vulnerability was determined in Eleveo Quality Management 9.7.0 in the Conversation Handler component, specifically in the file /enc-fwk-data/api/v3/conversations/<ID>/events. Manipulation of the createdBy argument causes dynamically-determined object attributes. The attack can be performed remotely. The exploit is public, and the vendor did not respond.
- CVE-2026-85407Medium
A vulnerability was found in Eleveo Quality Management 9.7.0 in the Conversation Handler component, specifically in the file /enc-fwk-data/api/v3/conversations/<ID>/events. Manipulation of the labels argument results in denial of service. The attack can be executed remotely. The exploit is public, and the vendor did not respond.
Original NVD description (English source)
A vulnerability has been found in Eleveo Quality Management 9.7.0. This vulnerability affects unknown code of the component Conversation Review. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.