| Título | Eleveo Quality Management 9.7.0 Stored Cross Site Scripting |
|---|
| Descrição | Multiple authenticated stored Cross-Site Scripting (XSS) vulnerabilities in Eleveo Quality Management 9.7.0 allowing remote attackers to inject arbitrary web script or HTML via the Comments, Improve, and Maintain fields in the (1) Conversation Review; the Internal notes, Things to improve, and Things to maintain fields in the (2) Conversation Grading; the display field in (3) Create Scoring Tiers, or (4) Edit Scoring Tiers; the answer and answer description fiends in (5) Create Questionnaire, or (6) Modify Questionnaire; the name field in (7) Create Tag, or (8) Edit Tag. Injected payloads are stored in the application and executed in the context of other authenticated users when they access multiple pages across the application. This allows attackers to perform actions such as session hijacking, executing malicious scripts, or manipulating the content displayed to users.
Impact
• Execution of arbitrary scripts in the context of authenticated users.
• Account compromise through session hijacking or theft of authentication tokens.
• Manipulation of application functionality or display by injecting malicious content.
• Disclosure of sensitive data accessible via the victim’s session.
PoC
Comprehensive reproduction steps, including supporting screenshots, are available via the shared private link. Public disclosure will occur on GitHub after the responsible disclosure period of approximately 90 days has elapsed.
Note
Contact with the vendor was initiated on April 5, and no response has been received as of the submission date. The provided PoC is accessible via a restricted link and is intended solely for review purposes by anyone possessing the link. I plan to reserve a CVE early, with public disclosure scheduled after 90 days from the initial contact date, at which point the advisory will be published on my GitHub repository. The information shared here is provided exclusively to the VulnDB team to ensure awareness and understanding of the vulnerability details. |
|---|
| Fonte | ⚠️ https://drive.google.com/file/d/12AssEiP2iGOM9UwkXM39TwGoPxOexHX2/view?usp=sharing |
|---|
| Utilizador | omarelshopky (UID 85487) |
|---|
| Submissão | 18/07/2026 14h40 (há 2 meses) |
|---|
| Moderação | 03/09/2026 20h45 (2 months later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 398556 [Eleveo Quality Management 9.7.0 Conversation Review Script de Site Cruzado] |
|---|
| Pontos | 20 |
|---|