CVE-2024-35286

critical · 9.8

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. A successful exploit could allow an attacker to access sensitive information and execute arbitrary database and management operations.

9.8

CVSS

65.7%

EPSS (exploit prob.)

99th

EPSS percentile

2024-10-21

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-89

Affected products

Vendor	Product	Affected versions
mitel	micollab	<= 9.8.0.33

Check a specific version with /api/v1/cve/match.

References

https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0014

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-35286