Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-101145: Eleveo Call Recording Software allows remote LDAP injection
CVE-2026-101145 · published 20 days ago
Summary
The user management page in Eleveo Call Recording Software can be tricked into sending malicious directory queries, letting an attacker manipulate or view data stored in the LDAP directory. This can be done from anywhere on the network and could lead to unauthorized access or changes. Apply any available vendor updates, limit access to the management interface, and monitor for unusual directory activity.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| eleveo | call recording software | 9.7.0 |
Original advisory text
Eleveo Call Recording Software User Management userAddAction.do ldap injection
A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /callrec/userAddAction.do of the component User Management. Such manipulation of the argument Username leads to ldap injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
2.1
Low
Type
CWE-90Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
CWE-74Injection
Timeline
Published28 Sep 2026
Updated19 Oct 2026
First seen28 Sep 2026
Track software like this
Free during beta