CVE-2024-9971

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The specific query functionality in the FlowMaster BPM Plus from NewType does not properly restrict user input, allowing remote attackers with regular privileges to inject SQL commands to read, modify, or delete database contents.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
NewType	FlowMaster BPM Plus	< 5.3.1
new_type	flowmaster_bpm_plus	< 5.3.1

References

https://www.twcert.org.tw/en/cp-139-8139-4daab-2.htmlThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-8138-d2bb7-1.htmlThird Party Advisory

Timeline

Published: Oct 15, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-99729.8Property Management System from ChanGate has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQ CVE-2024-99739.8A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been classified as critical. Affected is an unknown function of CVE-2024-99749.8A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been declared as critical. Affected by this vulnerability is an CVE-2024-99758.8A vulnerability was found in SourceCodester Drag and Drop Image Upload 1.0. It has been rated as critical. Affected by this issue is some un CVE-2024-99769.8A vulnerability classified as critical has been found in code-projects Pharmacy Management System 1.0. This affects an unknown part of the f CVE-2024-99774.7A vulnerability, which was classified as critical, was found in MitraStar GPT-2541GNAC BR_g5.6_1.11(WVK.0)b26. Affected is an unknown functi CVE-2024-99785.5in OpenHarmony v4.1.1 and prior versions allow a local attacker cause information leak through out-of-bounds Read.CVE-2024-99795.3A flaw was found in PyO3. This vulnerability causes a use-after-free issue, potentially leading to memory corruption or crashes via unsound CVE-2024-99808.8The ee-class from FormosaSoft does not properly validate a specific page parameter, allowing remote attackers with regular privileges to inj CVE-2024-99818.8The ee-class from FormosaSoft does not properly validate a specific page parameter, allowing remote attackers with regular privileges to upl CVE-2024-99829.8AIM LINE Marketing Platform from Esi Technology does not properly validate a specific query parameter. When the LINE Campaign Module is enab CVE-2024-99837.5Enterprise Cloud Database from Ragic does not properly validate a specific page parameter, allowing unauthenticated remote attackers to expl