{"id":"CVE-2026-101145","state":"PUBLISHED","title":"Eleveo Call Recording Software User Management userAddAction.do ldap injection","description":"A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /callrec/userAddAction.do of the component User Management. Such manipulation of the argument Username leads to ldap injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.","publishedAt":"2026-09-28T20:15:09.632Z","updatedAt":"2026-10-20T22:44:19.391Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["Eleveo Call Recording Software"],"affected":[{"vendor":"Eleveo","product":"Call Recording Software","versions":[{"version":"9.7.0","status":"affected"}],"cpes":["cpe:2.3:a:eleveo:call_recording_software:*:*:*:*:*:*:*:*"],"modules":["User Management"]}],"references":["https://vuldb.com/vuln/410997","https://vuldb.com/vuln/410997/cti","https://vuldb.com/cve/CVE-2026-101145","https://vuldb.com/submit/894911","https://github.com/omarelshopky/cves/tree/main/eleveo/call-recording-software/CVE-2026-101145"],"weaknesses":["CWE-90","CWE-74"],"ingestedAt":"2026-10-29T20:10:13.529Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/101xxx/CVE-2026-101145.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-101145","state":"PUBLISHED","datePublished":"2026-09-28T20:15:09.632Z","dateUpdated":"2026-10-20T22:44:19.391Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-09-28T08:11:31.271Z"},"containers":{"cna":{"title":"Eleveo Call Recording Software User Management userAddAction.do ldap injection","descriptions":[{"lang":"en","value":"A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /callrec/userAddAction.do of the component User Management. Such manipulation of the argument Username leads to ldap injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"vendor":"Eleveo","product":"Call Recording Software","versions":[{"version":"9.7.0","status":"affected"}],"cpes":["cpe:2.3:a:eleveo:call_recording_software:*:*:*:*:*:*:*:*"],"modules":["User Management"]}],"references":[{"url":"https://vuldb.com/vuln/410997","name":"VDB-410997 | Eleveo Call Recording Software User Management userAddAction.do ldap injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/410997/cti","name":"VDB-410997 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-101145","name":"CVE-2026-101145 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/894911","name":"Submit #894911 | Eleveo Call Recording Software 9.7.0 LDAP Injection","tags":["third-party-advisory"]},{"url":"https://github.com/omarelshopky/cves/tree/main/eleveo/call-recording-software/CVE-2026-101145","tags":["exploit"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-90","type":"CWE","lang":"en","description":"LDAP Injection"}]},{"descriptions":[{"cweId":"CWE-74","type":"CWE","lang":"en","description":"Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-10-20T22:44:19.391Z"},"timeline":[{"time":"2026-03-10T00:00:00.000Z","lang":"en","value":"Vendor informed"},{"time":"2026-09-28T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-09-28T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-10-21T00:49:14.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Omar Elshopky (Spark Professional Services)","type":"finder"},{"lang":"en","value":"omarelshopky (VulDB User)","type":"reporter"},{"lang":"en","value":"omarelshopky (VulDB User)","type":"analyst"},{"lang":"en","value":"VulDB CNA Team","type":"coordinator"}],"x_generator":["VulDB PVTS v202610"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-01T14:55:25.741267Z","id":"CVE-2026-101145","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-01T14:55:35.978Z"}}]}}}