CVE-2024-9971

—

CVSS 3.1

8.8 high

EPSS

<1%p49

Published

Oct 15, 2024 (Oct 15, 2024)

Modified

Jun 17, 2026

Description

The specific query functionality in the FlowMaster BPM Plus from NewType does not properly restrict user input, allowing remote attackers with regular privileges to inject SQL commands to read, modify, or delete database contents.

Vendors: newtype
Products: flowmaster bpm plus
Weakness: CWE-89
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news0 stories

No ingested article mentions this CVE yet.