CVE-2026-85405

Name of the Vulnerable Software and Affected Versions Eleveo Call Recording Software version 9.7.0

Description A flaw in the /callrec/roleAddAction.do endpoint allows remote attackers to perform cross site scripting (XSS), which is a technique used to inject malicious scripts into web pages viewed by other users. This is achieved by manipulating the name/username argument.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the name/username parameter in the /callrec/roleAddAction.do endpoint until the issue is resolved.