CVE-2024-9971

8.8 highEPSS 0.6%

High (8.8) in newtype flowmaster bpm plus. EPSS 0.6% chance of exploitation in the next 30 days.

The specific query functionality in the FlowMaster BPM Plus from NewType does not properly restrict user input, allowing remote attackers with regular privileges to inject SQL commands to read, modify, or delete database contents.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 51% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2024-10-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

newtype:flowmaster_bpm_plus

References

https://www.twcert.org.tw/en/cp-139-8139-4daab-2.html
https://www.twcert.org.tw/tw/cp-132-8138-d2bb7-1.html

Check your stack JSON