FlowMaster BPM Plus vulnerabilities

2 known vulnerabilities in FlowMaster BPM Plus from NewType. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  FlowMaster BPM Plus: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2024-9971Oct 15, 2024NewType

  The specific query functionality in the FlowMaster BPM Plus from NewType does not properly restrict user input, allowing remote attackers with regular privileges to inject SQL commands to read, modify, or delete database contents.

• 8.8 High severity

  FlowMaster BPM Plus: Reliance on Cookies without Validation and Integrity Checking

  CVE-2024-9970Oct 15, 2024NewType

  The FlowMaster BPM Plus system from NewType has a privilege escalation vulnerability. Remote attackers with regular privileges can elevate their privileges to administrator by tampering with a specific cookie.