CVE-2026-101141

Name of the Vulnerable Software and Affected Versions Eleveo Call Recording Software version 9.7.0

Description A flaw in the Play Audio Page component allows remote attackers to perform cross-site scripting (XSS), which is a technique used to inject malicious scripts into web pages viewed by other users. The issue exists within the /callrec/audio.jsp endpoint and is triggered by manipulating the viewRoleId/cfType argument.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the /callrec/audio.jsp endpoint to minimize the risk of exploitation.