The FlowMaster BPM Plus system from NewType has a privilege escalation vulnerability. Remote attackers with regular privileges can elevate their privileges to administrator by tampering with a specific cookie.
No PoCs from references.
- https://github.com/fkie-cad/nvd-json-data-feeds