Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for Bp Premier by Best Practice Software

    CVE-2026-114119 (GCVE-0-2026-114119)

    Vulnerability from nvd – Published: 2026-10-21 00:37 – Updated: 2026-10-21 00:37
    VLAI
    Title
    Best Practice Software Bp Premier before 1.14.1.1128 Hardcoded SQL Server Administrative Credential
    Summary
    Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM.
    Severity
    9.3 (Critical)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    9.8 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    CWE
    • CWE-798 - Use of Hard-coded Credentials
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 6843 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Best Practice Software Bp Premier Affected: 0 , < 1.14.1.1128 (custom)
    Unaffected: 1.14.1.1128 (custom)
    		Create a notification for this product.
    Date Public
    2026-09-25 00:00
    Credits
    Andrew Tunnecliffe (CI-ISAC Australia) CI-ISAC Australia
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Bp Premier",
          "vendor": "Best Practice Software",
          "versions": [
            {
              "lessThan": "1.14.1.1128",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "1.14.1.1128",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Andrew Tunnecliffe (CI-ISAC Australia)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "CI-ISAC Australia"
        }
      ],
      "datePublic": "2026-09-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-798",
              "description": "Use of Hard-coded Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T00:37:16.230Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Bp Premier Oxford SP1 Release Notes",
          "tags": [
            "release-notes",
            "patch"
          ],
          "url": "https://kb.bestpracticesoftware.com/bppremier/oxford/WhatsNew/BpPremier_OxfordSP1_ReleaseNotes.htm"
        },
        {
          "name": "CI-ISAC Australia GCVE-123-2026-0001",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://def.ci-isac.org.au/vuln/records/GCVE-123-2026-0001.json"
        },
        {
          "name": "VulnCheck Advisory: Best Practice Software Bp Premier before 1.14.1.1128 Hardcoded SQL Server Administrative Credential",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/best-practice-software-bp-premier-before-1.14.1.1128-hardcoded-sql-server-administrative-credential"
        }
      ],
      "title": "Best Practice Software Bp Premier before 1.14.1.1128 Hardcoded SQL Server Administrative Credential",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-114119",
    "datePublished": "2026-10-21T00:37:16.230Z",
    "dateReserved": "2026-10-20T21:48:58.503Z",
    "dateUpdated": "2026-10-21T00:37:16.230Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-114119 (GCVE-0-2026-114119)

    Vulnerability from cvelistv5 – Published: 2026-10-21 00:37 – Updated: 2026-10-21 00:37
    VLAI
    Title
    Best Practice Software Bp Premier before 1.14.1.1128 Hardcoded SQL Server Administrative Credential
    Summary
    Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM.
    Severity
    9.3 (Critical)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    9.8 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    CWE
    • CWE-798 - Use of Hard-coded Credentials
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 6843 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Best Practice Software Bp Premier Affected: 0 , < 1.14.1.1128 (custom)
    Unaffected: 1.14.1.1128 (custom)
    		Create a notification for this product.
    Date Public
    2026-09-25 00:00
    Credits
    Andrew Tunnecliffe (CI-ISAC Australia) CI-ISAC Australia
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Bp Premier",
          "vendor": "Best Practice Software",
          "versions": [
            {
              "lessThan": "1.14.1.1128",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "1.14.1.1128",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Andrew Tunnecliffe (CI-ISAC Australia)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "CI-ISAC Australia"
        }
      ],
      "datePublic": "2026-09-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-798",
              "description": "Use of Hard-coded Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T00:37:16.230Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Bp Premier Oxford SP1 Release Notes",
          "tags": [
            "release-notes",
            "patch"
          ],
          "url": "https://kb.bestpracticesoftware.com/bppremier/oxford/WhatsNew/BpPremier_OxfordSP1_ReleaseNotes.htm"
        },
        {
          "name": "CI-ISAC Australia GCVE-123-2026-0001",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://def.ci-isac.org.au/vuln/records/GCVE-123-2026-0001.json"
        },
        {
          "name": "VulnCheck Advisory: Best Practice Software Bp Premier before 1.14.1.1128 Hardcoded SQL Server Administrative Credential",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/best-practice-software-bp-premier-before-1.14.1.1128-hardcoded-sql-server-administrative-credential"
        }
      ],
      "title": "Best Practice Software Bp Premier before 1.14.1.1128 Hardcoded SQL Server Administrative Credential",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-114119",
    "datePublished": "2026-10-21T00:37:16.230Z",
    "dateReserved": "2026-10-20T21:48:58.503Z",
    "dateUpdated": "2026-10-21T00:37:16.230Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}