Priority Software maintains a focused vulnerability footprint around its enterprise resource planning and business management products, including Priority, Mashov, and its enterprise management system, which serve as operational backbone systems for mid-market organizations. The durable signal from its disclosures centers on application-layer input handling and authentication mechanisms characteristic of integrated business software. Live severity, exploitation, and current exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Priority Software over time
Signals from CVEs in this vendor scope (9 CVEs).
9 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-23460CRITICAL Priority Web version 19.1.0.68, parameter manipulation on an unspecified end-point may allow authentication bypass. | Feb 15, 2023 | 9.8 | 30 | NO | NO |
CVE-2023-23459CRITICAL Priority Windows may allow Command Execution via SQL Injection using an unspecified method. | Feb 15, 2023 | 9.8 | 30 | NO | NO |
CVE-2022-23173MEDIUM this vulnerability affect user that even not allowed to access via the web interface. First of all, the attacker needs to access the "Login menu - demo site" then he can see in thi | Jul 6, 2022 | 6.3 | 22 | NO | NO |
CVE-2024-41699HIGH Priority – CWE-552: Files or Directories Accessible to External Parties | Aug 20, 2024 | 7.5 | 20 | NO | NO |
CVE-2024-41698HIGH Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor | Aug 20, 2024 | 7.5 | 20 | NO | NO |
CVE-2021-26832MEDIUM Cross Site Scripting (XSS) in the "Reset Password" page form of Priority Enterprise Management System v8.00 allows attackers to execute javascript on behalf of the victim by sendin | Apr 14, 2021 | 6.1 | 20 | NO | NO |
CVE-2024-41697MEDIUM Priority - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | Aug 20, 2024 | 6.1 | 18 | NO | NO |
CVE-2024-41693MEDIUM Mashov - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | Jul 30, 2024 | 6.1 | 18 | NO | NO |
CVE-2022-23172MEDIUM An attacker can access to "Forgot my password" button, as soon as he puts users is valid in the system, the system would issue a message that a password reset email had been sent t | Jul 6, 2022 | 4.3 | 18 | NO | NO |
Signals from CVEs in this vendor scope (9 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Priority Software.
Media articles that mention a CVE ID that affects a product developed by Priority Software — matched by CVE ID, not by vendor name.