{"id":"CVE-2024-35286","title":"A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input","summary":"A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. A successful exploit could allow an attack…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-89"],"vendor":"mitel","product":"micollab","affected":["micollab <= 9.8.0.33"],"published":"2024-10-21","updated":"2026-11-03","sourceUpdated":"2026-11-03T22:17:19.387","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-35286","references":[{"url":"https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0014","label":"cve@mitre.org"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"total","timestamp":"2024-12-10T04:55:53.979893Z"},"epss":0.65732,"epssPercentile":0.99271,"exploits":{"nuclei":["CVE-2024-35286"],"checkedAt":"2026-11-07T17:44:29.040Z"},"ingestedAt":"2026-11-05T06:38:03.580Z","slug":"CVE-2024-35286","body":"## Overview\n\nA vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. A successful exploit could allow an attacker to access sensitive information and execute arbitrary database and management operations.\n\n## Affected\n\n- `micollab <= 9.8.0.33`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":79,"depthScoreParts":{"impact":53.9,"likelihood":13.1,"exploitation":12,"ransomware":0},"changes":[]}