{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15375", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-07-10T08:47:14.350Z", "datePublished": "2026-07-10T15:15:07.109Z", "dateUpdated": "2026-07-14T01:52:31.281Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-13T16:58:32.892Z"}, "title": "Eleveo Call Recording Software LDAP User users_ldap.jsp improper authorization", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-285", "lang": "en", "description": "Improper Authorization"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-266", "lang": "en", "description": "Incorrect Privilege Assignment"}]}], "affected": [{"vendor": "Eleveo", "product": "Call Recording Software", "versions": [{"version": "9.7.0", "status": "affected"}], "cpes": ["cpe:2.3:a:eleveo:call_recording_software:*:*:*:*:*:*:*:*"], "modules": ["LDAP User Interface"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in Eleveo Call Recording Software 9.7.0. This impacts an unknown function of the file /callrec/users_ldap.jsp of the component LDAP User Interface. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-03-10T00:00:00.000Z", "lang": "en", "value": "Vendor informed"}, {"time": "2026-07-10T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-07-10T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-07-13T19:00:08.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Omar Elshopky (Spark Professional Services)", "type": "finder"}, {"lang": "en", "value": "omarelshopky (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "omarelshopky (VulDB User)", "type": "analyst"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/377442", "name": "VDB-377442 | Eleveo Call Recording Software LDAP User users_ldap.jsp improper authorization", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/377442/cti", "name": "VDB-377442 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-15375", "name": "CVE-2026-15375 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/797459", "name": "Submit #797459 | Eleveo Call Recording 9.7.0 Broken Access Control", "tags": ["third-party-advisory"]}, {"url": "https://github.com/omarelshopky/cves/blob/main/eleveo/call-recording-software/CVE-2026-15375", "tags": ["exploit"]}]}, "adp": [{"references": [{"url": "https://github.com/omarelshopky/cves/tree/main/eleveo/call-recording-software/CVE-2026-15375", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-14T01:52:04.169937Z", "id": "CVE-2026-15375", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T01:52:31.281Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Eleveo Call Recording Software LDAP User users_ldap.jsp improper authorization", "credits": [{"lang": "en", "type": "finder", "value": "Omar Elshopky (Spark Professional Services)"}, {"lang": "en", "type": "reporter", "value": "omarelshopky (VulDB User)"}, {"lang": "en", "type": "analyst", "value": "omarelshopky (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:eleveo:call_recording_software:*:*:*:*:*:*:*:*"], "vendor": "Eleveo", "modules": ["LDAP User Interface"], "product": "Call Recording Software", "versions": [{"status": "affected", "version": "9.7.0"}]}], "timeline": [{"lang": "en", "time": "2026-03-10T00:00:00.000Z", "value": "Vendor informed"}, {"lang": "en", "time": "2026-07-10T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-07-10T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-07-13T19:00:08.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/377442", "name": "VDB-377442 | Eleveo Call Recording Software LDAP User users_ldap.jsp improper authorization", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/377442/cti", "name": "VDB-377442 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-15375", "name": "CVE-2026-15375 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/797459", "name": "Submit #797459 | Eleveo Call Recording 9.7.0 Broken Access Control", "tags": ["third-party-advisory"]}, {"url": "https://github.com/omarelshopky/cves/blob/main/eleveo/call-recording-software/CVE-2026-15375", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in Eleveo Call Recording Software 9.7.0. This impacts an unknown function of the file /callrec/users_ldap.jsp of the component LDAP User Interface. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "Improper Authorization"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-266", "description": "Incorrect Privilege Assignment"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-13T16:58:32.892Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-15375", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-14T01:52:04.169937Z"}}}], "references": [{"url": "https://github.com/omarelshopky/cves/tree/main/eleveo/call-recording-software/CVE-2026-15375", "tags": ["exploit"]}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-07-14T01:52:27.227Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-15375", "state": "PUBLISHED", "dateUpdated": "2026-07-13T16:58:32.892Z", "dateReserved": "2026-07-10T08:47:14.350Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-07-10T15:15:07.109Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "9.7.0"}}], "enrichment": {"confidence": 82.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 82.0, "source": "matching"}]}, "original": {"product": "Call Recording Software", "source": "cna", "vendor": "Eleveo"}, "product": "call_recording", "vendor": "eleveo"}], "created": "2026-07-11T11:00:06.123795+00:00", "updated": "2026-07-23T08:00:07.064630+00:00", "vendors": ["eleveo", "eleveo$PRODUCT$call_recording"]}