{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-101142",
        "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "state": "PUBLISHED",
        "assignerShortName": "VulDB",
        "dateReserved": "2026-09-28T08:11:21.155Z",
        "datePublished": "2026-09-28T19:30:11.384Z",
        "dateUpdated": "2026-10-20T22:25:53.402Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
                "shortName": "VulDB",
                "dateUpdated": "2026-10-20T22:25:53.402Z"
            },
            "title": "Eleveo Quality Management Questionnaire Audio Upload Scorecard.jsp path traversal",
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "type": "CWE",
                            "cweId": "CWE-22",
                            "lang": "en",
                            "description": "Path Traversal"
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "vendor": "Eleveo",
                    "product": "Quality Management",
                    "versions": [
                        {
                            "version": "9.7.0",
                            "status": "affected"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:eleveo:quality_management:*:*:*:*:*:*:*:*"
                    ],
                    "modules": [
                        "Questionnaire Audio Upload"
                    ]
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "value": "A vulnerability has been found in Eleveo Quality Management 9.7.0. Affected by this vulnerability is an unknown functionality of the file Scorecard.jsp of the component Questionnaire Audio Upload. The manipulation leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
                }
            ],
            "metrics": [
                {
                    "cvssV4_0": {
                        "version": "4.0",
                        "baseScore": 5.3,
                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
                        "baseSeverity": "MEDIUM"
                    }
                },
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "baseScore": 6.3,
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
                        "baseSeverity": "MEDIUM"
                    }
                },
                {
                    "cvssV3_0": {
                        "version": "3.0",
                        "baseScore": 6.3,
                        "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
                        "baseSeverity": "MEDIUM"
                    }
                },
                {
                    "cvssV2_0": {
                        "version": "2.0",
                        "baseScore": 6.5,
                        "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"
                    }
                }
            ],
            "timeline": [
                {
                    "time": "2026-04-05T00:00:00.000Z",
                    "lang": "en",
                    "value": "Vendor informed"
                },
                {
                    "time": "2026-09-28T00:00:00.000Z",
                    "lang": "en",
                    "value": "Advisory disclosed"
                },
                {
                    "time": "2026-09-28T02:00:00.000Z",
                    "lang": "en",
                    "value": "VulDB entry created"
                },
                {
                    "time": "2026-10-21T00:30:48.000Z",
                    "lang": "en",
                    "value": "VulDB entry last update"
                }
            ],
            "credits": [
                {
                    "lang": "en",
                    "value": "Omar Elshopky (Spark Professional Services)",
                    "type": "finder"
                },
                {
                    "lang": "en",
                    "value": "omarelshopky (VulDB User)",
                    "type": "reporter"
                },
                {
                    "lang": "en",
                    "value": "omarelshopky (VulDB User)",
                    "type": "analyst"
                },
                {
                    "lang": "en",
                    "value": "VulDB CNA Team",
                    "type": "coordinator"
                }
            ],
            "references": [
                {
                    "url": "https://vuldb.com/vuln/410994",
                    "name": "VDB-410994 | Eleveo Quality Management Questionnaire Audio Upload Scorecard.jsp path traversal",
                    "tags": [
                        "vdb-entry"
                    ]
                },
                {
                    "url": "https://vuldb.com/vuln/410994/cti",
                    "name": "VDB-410994 | CTI Indicators (IOB, IOC, TTP, IOA)",
                    "tags": [
                        "signature",
                        "permissions-required"
                    ]
                },
                {
                    "url": "https://vuldb.com/cve/CVE-2026-101142",
                    "name": "CVE-2026-101142 | CVE Analysis and Report",
                    "tags": [
                        "third-party-advisory"
                    ]
                },
                {
                    "url": "https://vuldb.com/submit/894895",
                    "name": "Submit #894895 | Eleveo Quality Management 9.7.0 Arbitrary File Read and Deletion",
                    "tags": [
                        "third-party-advisory"
                    ]
                },
                {
                    "url": "https://github.com/omarelshopky/cves/tree/main/eleveo/quality-management/CVE-2026-101142",
                    "tags": [
                        "exploit"
                    ]
                }
            ],
            "x_generator": [
                "VulDB PVTS v202610"
            ]
        },
        "adp": [
            {
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "timestamp": "2026-10-01T14:52:22.217088Z",
                                "id": "CVE-2026-101142",
                                "options": [
                                    {
                                        "Exploitation": "poc"
                                    },
                                    {
                                        "Automatable": "no"
                                    },
                                    {
                                        "Technical Impact": "partial"
                                    }
                                ],
                                "role": "CISA Coordinator",
                                "version": "2.0.3"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2026-10-01T14:52:31.929Z"
                }
            }
        ]
    }
}