CVE-2026-85406: Eleveo Quality Management Conversation Review cross site scripting
A vulnerability has been found in Eleveo Quality Management 9.7.0. This vulnerability affects unknown code of the component Conversation Review. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What access and interaction are required to exploit this issue?
The issue is remotely exploitable, but the supplied CVSS vector indicates an attacker needs low-level privileges and user interaction. The affected user must interact with attacker-controlled content for the cross-site scripting to take effect.
Which deployment should be considered affected?
Eleveo Quality Management version 9.7.0 is identified as affected, specifically the Conversation Review component. The vulnerable code location is not specified, so the available information does not establish whether any particular configuration avoids exposure.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used, which can increase the likelihood of attempted exploitation.
Is a vendor response or remediation available?
The available information states that the vendor was contacted early but did not respond. No patch, workaround, or mitigation is provided in the supplied data.