---
id: CVE-2024-35286
title: >-
  A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33
  allows an unauthenticated attacker to conduct a SQL injection attack due to
  insufficient sanitization of user input
summary: >-
  A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33
  allows an unauthenticated attacker to conduct a SQL injection attack due to
  insufficient sanitization of user input. A successful exploit could allow an
  attack…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-89
vendor: mitel
product: micollab
affected:
  - micollab <= 9.8.0.33
published: '2024-10-21'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T22:17:19.387'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-35286'
references:
  - url: >-
      https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0014
    label: cve@mitre.org
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2024-12-10T04:55:53.979893Z'
epss: 0.65732
epssPercentile: 0.99271
exploits:
  nuclei:
    - CVE-2024-35286
  checkedAt: '2026-11-07T17:44:29.040Z'
ingestedAt: '2026-11-05T06:38:03.580Z'
---

## Overview

A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. A successful exploit could allow an attacker to access sensitive information and execute arbitrary database and management operations.

## Affected

- `micollab <= 9.8.0.33`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.