CVE-2023-5046 CRITICAL

CVE-2023-5046: SQLi in Biltay's Procost

Vendor Biltay Technology

Product Procost

Weakness CWE-89 · SQLi

Published October 12, 2023

Last update May 21, 2026

View on NVD All CVEs

CVSS base score

9.8/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Biltay Technology Procost allows SQL Injection, Command Line Execution through SQL Injection. This issue affects Procost: before 1390.

Key dates

02Disclosure timeline

October 12, 2023 CVE published

May 21, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-5046 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html

Related vulnerabilities

04Related CVE

CVE-2025-11253 SQLi in Aksis Technologies' Netty ERP CVE-2024-8343 SourceCodester Sentiment Based Movie Rating System User Registration Users.php sql injection CVE-2022-2717 JoomSport – for Sports: Team & League, Football, Hockey & more <= 5.2.5 - Authentciated (Admin+) SQL Injection via orderby CVE-2023-47530 WordPress Redirect 404 Error Page to Homepage or Custom Page with Logs Plugin <= 1.8.7 is vulnerable to SQL Injection CVE-2025-49402 WordPress Exertio Framework Plugin <= 1.3.3 - SQL Injection Vulnerability