Priority
Monthly
Authentication bypass via hard-coded credentials in the Portal Generator add-on for Priority ERP (developed by Soft Solutions) allows remote, unauthenticated attackers to access the portal and read sensitive information belonging to other users or the underlying ERP. Reported by the Israel National Cyber Directorate (INCD) and rated CVSS 9.3, the flaw combines embedded static credentials (CWE-798), sensitive-information exposure (CWE-200), and improper access control (CWE-284). No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Authentication bypass in the Portal Generator Addon (developed by Soft Solutions) for Priority ERP allows remote, unauthenticated attackers to invoke a critical function that should be gated behind authentication, exposing sensitive ERP data. Rated CVSS 9.3 with a scope change, the flaw stems from a missing authentication check (CWE-306) on a network-reachable function. It was reported by Israel's National Cyber Directorate (INCD); no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated authentication bypass in the Portal Generator Addon to Priority ERP (developed by Soft Solutions) allows remote attackers with no credentials to access confidential ERP data across a scope boundary. Carrying a CVSS 3.1 score of 8.6 with Scope Changed and High Confidentiality impact, the flaw exposes the underlying Priority ERP backend through the portal layer - meaning business-critical records such as financial data, customer information, or operational records may be readable without any authentication. No public exploit code and no CISA KEV listing exist at time of analysis, but the attack profile (AV:N/AC:L/PR:N/UI:N) means exploitation requires minimal sophistication from any network position.
Unauthenticated information disclosure in the Portal Generator add-on to Priority ERP (developed by Soft Solutions) allows remote attackers to retrieve restricted data by bypassing security controls that are enforced only in the client rather than on the server. Any actor who can reach the portal over the network can craft direct server requests that skip the intended access checks, exposing sensitive data without credentials or user interaction. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated sensitive information disclosure in the Portal Generator Addon to Priority ERP (developed by Soft Solutions) allows remote attackers to retrieve private personal and business data without credentials or user interaction. Rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N) and reported by Israel's National Cyber Directorate (INCD), the flaw combines CWE-200 and CWE-359 exposure classes. No public exploit identified at time of analysis, and the product has a primarily Israeli deployment footprint.
Unauthenticated remote access control bypass in the Portal Generator Addon for Priority ERP (developed by Soft Solutions) enables network-accessible exploitation with no authentication or user interaction required. The flaw, classified as CWE-284 Improper Access Control and tagged explicitly as an Authentication Bypass, allows attackers to circumvent access restrictions, resulting in high-impact confidentiality exposure and limited data integrity impact against affected ERP portal deployments. Reported by the Israel National Cyber Directorate (INCD), no public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Authentication bypass in the Priority Portal Generator add-on for Priority ERP (developed by Soft Solutions) lets remote unauthenticated attackers reach protected portal functionality and, because of a scope change, the underlying ERP data it fronts. The maximum CVSS 10.0 rating reflects network reach, no privileges, and high confidentiality and integrity impact. Reported to Israel's INCD; no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis.
Unauthenticated remote information disclosure in the Portal Generator Addon for Priority ERP (developed by Soft Solutions) exposes sensitive ERP data to unauthorized network actors. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H) confirms that exploitation requires no credentials, no user interaction, and no special network position, yet achieves high confidentiality impact with a scope change that extends beyond the portal component into the underlying Priority ERP system. Reported by the Israel National Cyber Directorate (INCD), no public exploit code or CISA KEV listing has been identified at time of analysis.
Observable discrepancy exposure in the Priority Portal Generator Addon to Priority ERP (developed by Soft Solutions) enables unauthenticated remote attackers to enumerate internal state through differential system responses. Reported by the Israeli National Cyber Directorate (INCD), the flaw carries a CVSS 3.1 score of 5.3 (Medium) with a fully unauthenticated, low-complexity network attack vector. No public exploit code or active exploitation has been identified at time of analysis, but the enumeration primitive is classically useful for follow-on targeting of business-critical ERP data.
Priority - CWE-552: Files or Directories Accessible to External Parties. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Priority - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Priority - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Priority Web version 19.1.0.68, parameter manipulation on an unspecified end-point may allow authentication bypass. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Priority Windows may allow Command Execution via SQL Injection using an unspecified method. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
this vulnerability affect user that even not allowed to access via the web interface. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An attacker can access to "Forgot my password" button, as soon as he puts users is valid in the system, the system would issue a message that a password reset email had been sent to user. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authentication bypass via hard-coded credentials in the Portal Generator add-on for Priority ERP (developed by Soft Solutions) allows remote, unauthenticated attackers to access the portal and read sensitive information belonging to other users or the underlying ERP. Reported by the Israel National Cyber Directorate (INCD) and rated CVSS 9.3, the flaw combines embedded static credentials (CWE-798), sensitive-information exposure (CWE-200), and improper access control (CWE-284). No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Authentication bypass in the Portal Generator Addon (developed by Soft Solutions) for Priority ERP allows remote, unauthenticated attackers to invoke a critical function that should be gated behind authentication, exposing sensitive ERP data. Rated CVSS 9.3 with a scope change, the flaw stems from a missing authentication check (CWE-306) on a network-reachable function. It was reported by Israel's National Cyber Directorate (INCD); no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated authentication bypass in the Portal Generator Addon to Priority ERP (developed by Soft Solutions) allows remote attackers with no credentials to access confidential ERP data across a scope boundary. Carrying a CVSS 3.1 score of 8.6 with Scope Changed and High Confidentiality impact, the flaw exposes the underlying Priority ERP backend through the portal layer - meaning business-critical records such as financial data, customer information, or operational records may be readable without any authentication. No public exploit code and no CISA KEV listing exist at time of analysis, but the attack profile (AV:N/AC:L/PR:N/UI:N) means exploitation requires minimal sophistication from any network position.
Unauthenticated information disclosure in the Portal Generator add-on to Priority ERP (developed by Soft Solutions) allows remote attackers to retrieve restricted data by bypassing security controls that are enforced only in the client rather than on the server. Any actor who can reach the portal over the network can craft direct server requests that skip the intended access checks, exposing sensitive data without credentials or user interaction. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated sensitive information disclosure in the Portal Generator Addon to Priority ERP (developed by Soft Solutions) allows remote attackers to retrieve private personal and business data without credentials or user interaction. Rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N) and reported by Israel's National Cyber Directorate (INCD), the flaw combines CWE-200 and CWE-359 exposure classes. No public exploit identified at time of analysis, and the product has a primarily Israeli deployment footprint.
Unauthenticated remote access control bypass in the Portal Generator Addon for Priority ERP (developed by Soft Solutions) enables network-accessible exploitation with no authentication or user interaction required. The flaw, classified as CWE-284 Improper Access Control and tagged explicitly as an Authentication Bypass, allows attackers to circumvent access restrictions, resulting in high-impact confidentiality exposure and limited data integrity impact against affected ERP portal deployments. Reported by the Israel National Cyber Directorate (INCD), no public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Authentication bypass in the Priority Portal Generator add-on for Priority ERP (developed by Soft Solutions) lets remote unauthenticated attackers reach protected portal functionality and, because of a scope change, the underlying ERP data it fronts. The maximum CVSS 10.0 rating reflects network reach, no privileges, and high confidentiality and integrity impact. Reported to Israel's INCD; no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis.
Unauthenticated remote information disclosure in the Portal Generator Addon for Priority ERP (developed by Soft Solutions) exposes sensitive ERP data to unauthorized network actors. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H) confirms that exploitation requires no credentials, no user interaction, and no special network position, yet achieves high confidentiality impact with a scope change that extends beyond the portal component into the underlying Priority ERP system. Reported by the Israel National Cyber Directorate (INCD), no public exploit code or CISA KEV listing has been identified at time of analysis.
Observable discrepancy exposure in the Priority Portal Generator Addon to Priority ERP (developed by Soft Solutions) enables unauthenticated remote attackers to enumerate internal state through differential system responses. Reported by the Israeli National Cyber Directorate (INCD), the flaw carries a CVSS 3.1 score of 5.3 (Medium) with a fully unauthenticated, low-complexity network attack vector. No public exploit code or active exploitation has been identified at time of analysis, but the enumeration primitive is classically useful for follow-on targeting of business-critical ERP data.
Priority - CWE-552: Files or Directories Accessible to External Parties. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Priority - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Priority - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Priority Web version 19.1.0.68, parameter manipulation on an unspecified end-point may allow authentication bypass. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Priority Windows may allow Command Execution via SQL Injection using an unspecified method. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
this vulnerability affect user that even not allowed to access via the web interface. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An attacker can access to "Forgot my password" button, as soon as he puts users is valid in the system, the system would issue a message that a password reset email had been sent to user. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.