https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-67823.htmlhttps://patchthecve.com/cve/CVE-2025-67823.htmlWed, 17 Jun 2026 09:58:08 +0000HIGH 8.2: A vulnerability in the Multimedia Email component of Mitel MiContact Center Business through 10.2.0.10 and Mitel CX through 1.1.0.1 could allow an unauthenticated attacker to conduct a Cross-Site Scripting (XSS) attack due to insufficient input validation. A successful exploit requires user interacthttps://patchthecve.com/cve/CVE-2025-67822.htmlhttps://patchthecve.com/cve/CVE-2025-67822.htmlWed, 17 Jun 2026 09:58:08 +0000CRITICAL 9.4: A vulnerability in the Provisioning Manager component of Mitel MiVoice MX-ONE 7.3 (7.3.0.0.50) through 7.8 SP1 (7.8.1.0.14) could allow an unauthenticated attacker to conduct an authentication bypass attack due to improper authentication mechanisms. A successful exploit could allow an attacker to gahttps://patchthecve.com/cve/CVE-2025-52914.htmlhttps://patchthecve.com/cve/CVE-2025-52914.htmlWed, 17 Jun 2026 09:37:16 +0000HIGH 8.8: A vulnerability in the Suite Applications Services component of Mitel MiCollab 10.0 through SP1 FP1 (10.0.1.101) could allow an authenticated attacker to conduct a SQL Injection attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary SQLhttps://patchthecve.com/cve/CVE-2024-55550.htmlhttps://patchthecve.com/cve/CVE-2024-55550.htmlTue, 04 Aug 2026 05:16:31 +0000LOW 2.7: Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successful exploit could allow the authenticated admin attacker to access resources that are constrained to the admin access levehttps://patchthecve.com/cve/CVE-2024-47224.htmlhttps://patchthecve.com/cve/CVE-2024-47224.htmlWed, 17 Jun 2026 07:56:45 +0000MEDIUM 6.5: A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a CRLF injection attack due to inadequate encoding of user input in URLs. A successful exploit could allow an attacker to perfhttps://patchthecve.com/cve/CVE-2024-41714.htmlhttps://patchthecve.com/cve/CVE-2024-41714.htmlWed, 17 Jun 2026 07:48:06 +0000HIGH 8.8: A vulnerability in the Web Interface component of Mitel MiCollab through 9.8 SP1 (9.8.1.5) and MiVoice Business Solution Virtual Instance (MiVB SVI) through 1.0.0.27 could allow an authenticated attacker to conduct a command injection attack, due to insufficient parameter sanitization. A successful https://patchthecve.com/cve/CVE-2024-41713.htmlhttps://patchthecve.com/cve/CVE-2024-41713.htmlTue, 04 Aug 2026 05:16:30 +0000CRITICAL 9.1: A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attahttps://patchthecve.com/cve/CVE-2024-41712.htmlhttps://patchthecve.com/cve/CVE-2024-41712.htmlWed, 17 Jun 2026 07:48:06 +0000MEDIUM 6.6: A vulnerability in the Web Conferencing Component of Mitel MiCollab through 9.8.1.5 could allow an authenticated attacker to conduct a command injection attack, due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary commands on the system withhttps://patchthecve.com/cve/CVE-2024-35315.htmlhttps://patchthecve.com/cve/CVE-2024-35315.htmlWed, 17 Jun 2026 07:34:44 +0000MEDIUM 5.6: A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.25, could allow an authenticated attacker to conduct a privilege escalation attack due to improper file validation. A successful exploit could allow an attacker https://patchthecve.com/cve/CVE-2024-35314.htmlhttps://patchthecve.com/cve/CVE-2024-35314.htmlWed, 17 Jun 2026 07:34:44 +0000CRITICAL 9.8: A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.25, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit requires user https://patchthecve.com/cve/CVE-2024-35287.htmlhttps://patchthecve.com/cve/CVE-2024-35287.htmlWed, 17 Jun 2026 07:34:41 +0000MEDIUM 6.7: A vulnerability in the NuPoint Messenger (NPM) component of Mitel MiCollab through version 9.8 SP1 (9.8.1.5) could allow an authenticated attacker with administrative privilege to conduct a privilege escalation attack due to the execution of a resource with unnecessary privileges. A successful explohttps://patchthecve.com/cve/CVE-2024-35286.htmlhttps://patchthecve.com/cve/CVE-2024-35286.htmlWed, 17 Jun 2026 07:34:41 +0000CRITICAL 9.8: A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. A successful exploit could allow an attacker to access sensitive information and execute arbitrary databahttps://patchthecve.com/cve/CVE-2024-35285.htmlhttps://patchthecve.com/cve/CVE-2024-35285.htmlWed, 17 Jun 2026 07:34:41 +0000CRITICAL 9.8: A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization.https://patchthecve.com/cve/CVE-2024-30160.htmlhttps://patchthecve.com/cve/CVE-2024-30160.htmlWed, 17 Jun 2026 07:26:23 +0000MEDIUM 4.8: A vulnerability in the Suite Applications Services component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a Stored Cross-Site Scripting (XSS) attack due to insufficient validation of user input. A successful exploit could allow ahttps://patchthecve.com/cve/CVE-2024-30159.htmlhttps://patchthecve.com/cve/CVE-2024-30159.htmlWed, 17 Jun 2026 07:26:23 +0000MEDIUM 4.8: A vulnerability in the web conferencing component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a Stored Cross-Site Scripting (XSS) attack due to insufficient validation of user input. A successful exploit could allow an attacker https://patchthecve.com/cve/CVE-2024-30158.htmlhttps://patchthecve.com/cve/CVE-2024-30158.htmlWed, 17 Jun 2026 07:26:23 +0000HIGH 7.2: A vulnerability in the web conferencing component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a SQL Injection attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitraryhttps://patchthecve.com/cve/CVE-2024-30157.htmlhttps://patchthecve.com/cve/CVE-2024-30157.htmlWed, 17 Jun 2026 07:26:22 +0000HIGH 7.2: A vulnerability in the Suite Applications Services component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a SQL Injection attack due to insufficient validation of user input. A successful exploit could allow an attacker to executhttps://patchthecve.com/cve/CVE-2024-47912.htmlhttps://patchthecve.com/cve/CVE-2024-47912.htmlWed, 17 Jun 2026 07:57:58 +0000HIGH 8.2: A vulnerability in the AWV (Audio, Web, and Video) Conferencing component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to perform unauthorized data-access attacks due to missing authentication mechanisms. A successful exploit could allow an attacker to achttps://patchthecve.com/cve/CVE-2024-47223.htmlhttps://patchthecve.com/cve/CVE-2024-47223.htmlWed, 17 Jun 2026 07:56:45 +0000CRITICAL 9.4: A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. A successful exploit could allow an attacker to access https://patchthecve.com/cve/CVE-2024-47189.htmlhttps://patchthecve.com/cve/CVE-2024-47189.htmlWed, 17 Jun 2026 07:56:41 +0000HIGH 7.7: The API Interface of the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct SQL injection due to insufficient sanitization of user input. A successful exploit could allow an attacker with knowledge ofhttps://patchthecve.com/cve/CVE-2024-42514.htmlhttps://patchthecve.com/cve/CVE-2024-42514.htmlWed, 17 Jun 2026 07:49:35 +0000HIGH 8.1: A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.1.0.4 could allow an unauthenticated attacker to conduct an unauthorized access attack due to inadequate access control checks. A successful exploit requires user interaction and could allow an attacker to acchttps://patchthecve.com/cve/CVE-2024-36446.htmlhttps://patchthecve.com/cve/CVE-2024-36446.htmlWed, 17 Jun 2026 07:36:44 +0000HIGH 8.8: The provisioning manager component of Mitel MiVoice MX-ONE through 7.6 SP1 could allow an authenticated attacker to conduct an authentication bypass attack due to improper access control. A successful exploit could allow an attacker to bypass the authorization schema.https://patchthecve.com/cve/CVE-2024-41710.htmlhttps://patchthecve.com/cve/CVE-2024-41710.htmlWed, 17 Jun 2026 07:48:05 +0000HIGH 7.2: A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated attacker with administrative privilege to conduct an argument injection attack, due to insufficient parameter sanitizathttps://patchthecve.com/cve/CVE-2024-37570.htmlhttps://patchthecve.com/cve/CVE-2024-37570.htmlWed, 17 Jun 2026 07:38:37 +0000HIGH 8.8: On Mitel 6869i 4.5.0.41 devices, the Manual Firmware Update (upgrade.html) page does not perform sanitization on the username and path parameters (sent by an authenticated user) before appending flags to the busybox ftpget command. This leads to $() command execution.https://patchthecve.com/cve/CVE-2024-37569.htmlhttps://patchthecve.com/cve/CVE-2024-37569.htmlWed, 17 Jun 2026 07:38:37 +0000HIGH 8.8: An issue was discovered on Mitel 6869i through 4.5.0.41 and 5.x through 5.0.0.1018 devices. A command injection vulnerability exists in the hostname parameter taken in by the provis.html endpoint. The provis.html endpoint performs no sanitization on the hostname parameter (sent by an authenticated uhttps://patchthecve.com/cve/CVE-2024-35284.htmlhttps://patchthecve.com/cve/CVE-2024-35284.htmlWed, 17 Jun 2026 07:34:41 +0000MEDIUM 5.4: A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient input validation.https://patchthecve.com/cve/CVE-2024-35283.htmlhttps://patchthecve.com/cve/CVE-2024-35283.htmlWed, 17 Jun 2026 07:34:40 +0000MEDIUM 6.1: A vulnerability in the Ignite component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a stored cross-site scripting (XSS) attack due to insufficient input validation.https://patchthecve.com/cve/CVE-2024-28066.htmlhttps://patchthecve.com/cve/CVE-2024-28066.htmlWed, 17 Jun 2026 07:20:54 +0000HIGH 8.8: In Unify CP IP Phone firmware 1.10.4.3, Weak Credentials are used (a hardcoded root password).https://patchthecve.com/cve/CVE-2023-40266.htmlhttps://patchthecve.com/cve/CVE-2023-40266.htmlWed, 17 Jun 2026 06:16:56 +0000CRITICAL 9.8: An issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911. It allows path traversal.https://patchthecve.com/cve/CVE-2023-40265.htmlhttps://patchthecve.com/cve/CVE-2023-40265.htmlWed, 17 Jun 2026 06:16:56 +0000HIGH 8.8: An issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911. It allows authenticated remote code execution via file upload.