CVE-2024-35286
CRITICAL EXPLOITED NUCLEIMitel MiCollab < 9.8.0.33 - Unauthenticated SQL Injection in NuPoint Messenger
Title source: llmExploitation Summary
CVE-2024-35286 has been observed exploited in the wild (reported by VulnCheck KEV). A Nuclei detection template is also available.
Description
A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. A successful exploit could allow an attacker to access sensitive information and execute arbitrary database and management operations.
Nuclei Templates (1)
Mitel MiCollab <= 9.8.0.33 - SQL Injection
CRITICALVERIFIEDby daffainfo
Shodan:
html:"Mitel" html:"MiCollab"
References (1)
Core 1
Core References
Scores
CVSS v3
9.8
EPSS
0.6556
EPSS Percentile
99.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
total
Details
VulnCheck KEV
2024-12-10
CWE
CWE-89
Status
published
Products (1)
mitel/micollab
< 9.8.0.33
Published
Oct 21, 2024
Tracked Since
Feb 18, 2026