EUVD-2026-57770
GHSA-w88w-7hjf-77f6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated remote, low-complexity data exposure justifies AV:N/AC:L/PR:N/C:H; integrity set to N because CWE-200/359 describe read-only disclosure, contradicting the input's I:H.
Primary rating from Vendor (INCD).
CVSS VectorVendor: INCD
Lifecycle Timeline
2DescriptionCVE.org
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
AnalysisAI
Unauthenticated sensitive information disclosure in the Portal Generator Addon to Priority ERP (developed by Soft Solutions) allows remote attackers to retrieve private personal and business data without credentials or user interaction. Rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N) and reported by Israel's National Cyber Directorate (INCD), the flaw combines CWE-200 and CWE-359 exposure classes. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only that an instance of the Portal Generator Addon to Priority ERP be network-reachable by the attacker; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no special access, and no user interaction against a reachable portal. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are partially conflicting and should be read carefully. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch or fixed version was identified in the available data, so a specific upgrade target cannot yet be cited - monitor Soft Solutions and the INCD advisory listing (https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing) for the fixed release and apply it once published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Priority ERP with Portal Generator Addon, assess network exposure, and offline affected portals or restrict access to internal networks only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in the Priority Portal Generator add-on for Priority ERP (developed by Soft Solutions) lets remote
Authentication bypass in the Portal Generator Addon (developed by Soft Solutions) for Priority ERP allows remote, unauth
Authentication bypass via hard-coded credentials in the Portal Generator add-on for Priority ERP (developed by Soft Solu
Unauthenticated information disclosure in the Portal Generator add-on to Priority ERP (developed by Soft Solutions) allo
Unauthenticated authentication bypass in the Portal Generator Addon to Priority ERP (developed by Soft Solutions) allows
Unauthenticated remote information disclosure in the Portal Generator Addon for Priority ERP (developed by Soft Solution
Unauthenticated remote access control bypass in the Portal Generator Addon for Priority ERP (developed by Soft Solutions
Observable discrepancy exposure in the Priority Portal Generator Addon to Priority ERP (developed by Soft Solutions) ena
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today