Priority CVE-2023-23459

CRITICAL

SQL Injection (CWE-89)

2023-02-15 cna@cyber.gov.il

SQLi Microsoft Priority Priority Software

9.8

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

1

CVE Published

Feb 15, 2023 - 19:15 nvd

CRITICAL 9.8

DescriptionNVD

Priority Windows may allow Command Execution via SQL Injection using an unspecified method.

AnalysisAI

Priority Windows may allow Command Execution via SQL Injection using an unspecified method. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as SQL Injection (CWE-89), which allows attackers to execute arbitrary SQL commands against the database. Priority Windows may allow Command Execution via SQL Injection using an unspecified method. Affected products include: Priority-Software Priority.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use parameterized queries/prepared statements. Never concatenate user input into SQL. Apply least-privilege database permissions.

More in Priority

View all

CVE-2026-59500 CRITICAL Act Now

Authentication bypass in the Priority Portal Generator add-on for Priority ERP (developed by Soft Solutions) lets remote

CVE-2023-23460 CRITICAL Act Now

Priority Web version 19.1.0.68, parameter manipulation on an unspecified end-point may allow authentication bypass. Rate

CVE-2026-59506 CRITICAL Act Now

Authentication bypass in the Portal Generator Addon (developed by Soft Solutions) for Priority ERP allows remote, unauth

CVE-2026-59507 CRITICAL Act Now

Authentication bypass via hard-coded credentials in the Portal Generator add-on for Priority ERP (developed by Soft Solu

CVE-2026-59504 CRITICAL Act Now

Unauthenticated information disclosure in the Portal Generator add-on to Priority ERP (developed by Soft Solutions) allo

CVE-2026-59503 CRITICAL Act Now

Unauthenticated sensitive information disclosure in the Portal Generator Addon to Priority ERP (developed by Soft Soluti

CVE-2026-59505 HIGH This Week

Unauthenticated authentication bypass in the Portal Generator Addon to Priority ERP (developed by Soft Solutions) allows

CVE-2026-59499 HIGH This Week

Unauthenticated remote information disclosure in the Portal Generator Addon for Priority ERP (developed by Soft Solution

CVE-2026-59501 HIGH This Week

Unauthenticated remote access control bypass in the Portal Generator Addon for Priority ERP (developed by Soft Solutions

CVE-2024-41699 HIGH This Week

Priority - CWE-552: Files or Directories Accessible to External Parties. Rated high severity (CVSS 7.5), this vulnerabil

CVE-2024-41698 HIGH This Week

Priority - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Rated high severity (CVSS 7.5), this vul

CVE-2022-23173 MEDIUM This Month

this vulnerability affect user that even not allowed to access via the web interface. Rated medium severity (CVSS 6.3),

Same weakness CWE-89 – SQL Injection

View all

CVE-2023-48788 CRITICAL POC

CVE-2019-7481 HIGH POC

CVE-2025-57819 CRITICAL POC

CVE-2017-8917 CRITICAL POC

CVE-2024-27956 CRITICAL POC

CVE-2014-3704 HIGH POC

CVE-2016-2555 CRITICAL POC

CVE-2016-8582 CRITICAL POC

Same technique SQLi

View all

CVE-2019-7481 HIGH POC

CVE-2025-57819 CRITICAL POC

CVE-2017-8917 CRITICAL POC

CVE-2024-27956 CRITICAL POC

CVE-2014-3704 HIGH POC

CVE-2016-2555 CRITICAL POC

CVE-2016-8582 CRITICAL POC

CVE-2013-0333 HIGH POC

Share

CVE-2023-23459 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy