CVE-2026-85406: falha de média gravidade em Eleveo Quality Management
Eleveo Quality Management Conversation Review cross site scripting
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
33Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 5.1epss 0.3%
A vulnerability has been found in Eleveo Quality Management 9.7.0. This vulnerability affects unknown code of the component Conversation Review. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Produtos afetados
Eleveo · Quality ManagementPoCs públicas encontradas — 2
cve_referencedrive.google.com/file/d/12AssEiP2iGOM9UwkXM39TwGoPxOexHX2/view?usp=sharingnão verificadocve_referencegithub.com/omarelshopky/cves/tree/main/eleveo/quality-management/CVE-2026-85406não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Eleveo Quality Management
No mesmo produto, das mais perigosas para as menos.
CVE-2026-85409MEDIUMEleveo Quality Management Questionnaire Service QuestionnaireService.runDataExportNow path traversalEPSS 0.5%CVE-2026-85407MEDIUMEleveo Quality Management Conversation events denial of serviceEPSS 0.5%CVE-2026-85408MEDIUMEleveo Quality Management Conversation events dynamically-determined object attributesEPSS 0.4%CVE-2026-101142MEDIUMEleveo Quality Management Questionnaire Audio Upload Scorecard.jsp path traversalEPSS 0.3%CVE-2026-101146MEDIUMEleveo Quality Management GWT RPC QMUtilsService UtilsService.createAndSaveAudit information disclosureEPSS 0.3%CVE-2026-101143MEDIUMEleveo Quality Management QMBODownload information disclosureEPSS 0.3%