CVE-2024-35286 - A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input

Back Back to CVE browser

CRITICAL

A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input

Published Oct 21, 2024

9.8

CRITICAL

CVSS 3.1

EPSS 65.73%

Description

A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. A successful exploit could allow an attacker to access sensitive information and execute arbitrary database and management operations.

Affected products

Vendor Mitel Product Micollab Default
unknown
Affected
- ≥ 0, ≤ 9.8.0.33

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Mitel	Micollab	unknown	Affected ≥ 0, ≤ 9.8.0.33

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-35742
Advisory
https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0014
Vendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-35742		Advisory
https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0014		Vendor Advisory

Change history (3)

Sep 23, 2026, 23:05 UTC CISA ADP
- SSVC exploitation
  changed from poc to none
Sep 22, 2026, 07:32 UTC CISA ADP
- SSVC exploitation
  changed from none to poc
Sep 22, 2026, 07:20 UTC CISA ADP
- SSVC exploitation
  changed from poc to none

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Oct 21, 2024

Updated Dec 10, 2024

Reserved May 15, 2024

Link CVE-2024-35286

CISA Vulnrichment

Updated Dec 7, 2024

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2024-35286

Red Hat

No data

ENISA EUVD

Assigner mitre

Published Oct 21, 2024

Updated Dec 10, 2024

Link EUVD-2024-35742

GitHub

No data