Vulnerabilities

Filters

Reset all

1 selected

34 records

Sort

Vendor: Naviwebs Clear all filters

TI-2020-19189 CVE-2020-37054 · GHSA-5mv9-7wfj-624h

Navigate CMS 2.8.7 - Cross-Site Request Forgery

MEDIUM 56

Navigate CMS 2.8.7 contains a cross-site request forgery vulnerability that allows attackers to upload malicious extensions through a crafted HTML page.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00231 Published 2026-01-30 No fix listed CWE-352

TI-2020-19188 CVE-2020-37053 · GHSA-j2fj-xcrm-m79v

Navigate CMS 2.8.7 - ''sidx' SQL Injection

MEDIUM 64

Navigate CMS 2.8.7 contains an authenticated SQL injection vulnerability that allows attackers to leak database information by manipulating the 'sidx' parameter in comments.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00375 Published 2026-01-30 No fix listed CWE-89

TI-2022-10922 CVE-2022-28117 · GHSA-7fhp-7mjj-8x4m

A Server-Side Request Forgery (SSRF) in feed_parser class of Navigate CMS v2.9.4 allows…

MEDIUM 43

A Server-Side Request Forgery (SSRF) in feed_parser class of Navigate CMS v2.9.4 allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the feed parameter.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.22903 Published 2022-04-28 No fix listed CWE-918

TI-2021-19946 CVE-2021-44299 · GHSA-wvvr-pwf3-q292

A reflected cross-site scripting (XSS) vulnerability in \lib\packages\themes\themes.php…

LOW 25

A reflected cross-site scripting (XSS) vulnerability in \lib\packages\themes\themes.php of Navigate CMS v2.9.4 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00438 Published 2022-01-19 No fix listed CWE-79

TI-2021-19967 CVE-2021-44351 · GHSA-h5fr-hwjp-jh8f

An arbitrary file read vulnerability exists in NavigateCMS 2.9 via /navigate/navigate_download.php id parameter.

LOW 37

An arbitrary file read vulnerability exists in NavigateCMS 2.9 via /navigate/navigate_download.php id parameter.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01834 Published 2022-01-06 No fix listed CWE-22

TI-2021-14773 CVE-2021-36455 · GHSA-jxm8-2c34-9c94

SQL Injection vulnerability in Naviwebs Navigate CMS 2.9 via the quicksearch parameter in…

MEDIUM 40

SQL Injection vulnerability in Naviwebs Navigate CMS 2.9 via the quicksearch parameter in \lib\packages\comments\comments.php.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01104 Published 2021-08-06 No fix listed CWE-89

TI-2021-14772 CVE-2021-36454 · GHSA-gh7r-jpw7-q393

Cross Site Scripting (XSS) vulnerability in Naviwebs Navigate Cms 2.9 via the…

LOW 25

Cross Site Scripting (XSS) vulnerability in Naviwebs Navigate Cms 2.9 via the navigate-quickse parameter to 1) backups\backups.php, 2) blocks\blocks.php, 3) brands\brands.php, 4) comments\comments.php, 5) coupons\coupons…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00552 Published 2021-08-06 No fix listed CWE-79

TI-2020-14498 CVE-2020-23243 · GHSA-5598-8x8f-xfh9

Cross Site Scripting (XSS) vulnerability in NavigateCMS NavigateCMS 2.9 via the name="wrong_path_redirect" feature.

LOW 23

Cross Site Scripting (XSS) vulnerability in NavigateCMS NavigateCMS 2.9 via the name="wrong_path_redirect" feature.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00527 Published 2021-07-26 No fix listed CWE-79

TI-2020-14497 CVE-2020-23242 · GHSA-c4c2-23wc-qgqf

Cross Site Scripting (XSS) vulnerability in NavigateCMS 2.9 when performing a Create or Edit via the Tools feature.

LOW 23

Cross Site Scripting (XSS) vulnerability in NavigateCMS 2.9 when performing a Create or Edit via the Tools feature.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00527 Published 2021-07-26 No fix listed CWE-79

TI-2021-15406 CVE-2021-37478 · GHSA-4cm6-chgx-25m7

In NavigateCMS version 2.9.4 and below, function `block` is vulnerable to sql injection…

MEDIUM 46

In NavigateCMS version 2.9.4 and below, function `block` is vulnerable to sql injection on parameter `block-order`, which results in arbitrary sql query execution in the backend database.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02162 Published 2021-07-26 No fix listed CWE-89

TI-2021-15405 CVE-2021-37477 · GHSA-h4hg-cfwf-v789

In NavigateCMS version 2.9.4 and below, function in `structure.php` is vulnerable to sql…

MEDIUM 46

In NavigateCMS version 2.9.4 and below, function in `structure.php` is vulnerable to sql injection on parameter `children_order`, which results in arbitrary sql query execution in the backend database.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02162 Published 2021-07-26 No fix listed CWE-89

TI-2021-15404 CVE-2021-37476 · GHSA-4h9f-h6qv-gjwr

In NavigateCMS version 2.9.4 and below, function in `product.php` is vulnerable to sql…

MEDIUM 46

In NavigateCMS version 2.9.4 and below, function in `product.php` is vulnerable to sql injection on parameter `id` through a post request, which results in arbitrary sql query execution in the backend database.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02162 Published 2021-07-26 No fix listed CWE-89

TI-2021-15403 CVE-2021-37475 · GHSA-4ggj-mf5p-824g

In NavigateCMS version 2.9.4 and below, function in `templates.php` is vulnerable to sql…

MEDIUM 47

In NavigateCMS version 2.9.4 and below, function in `templates.php` is vulnerable to sql injection on parameter `template-properties-order`, which results in arbitrary sql query execution in the backend database.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02483 Published 2021-07-26 No fix listed CWE-89

TI-2021-15402 CVE-2021-37473 · GHSA-fxv7-rj9f-m6jp

In NavigateCMS version 2.9.4 and below, function in `product.php` is vulnerable to sql…

MEDIUM 46

In NavigateCMS version 2.9.4 and below, function in `product.php` is vulnerable to sql injection on parameter `products-order` through a post request, which results in arbitrary sql query execution in the backend databas…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02162 Published 2021-07-26 No fix listed CWE-89

TI-2020-14650 CVE-2020-23711 · GHSA-f394-4w7g-992w

SQL Injection vulnerability in NavigateCMS 2.9 via the URL encoded GET input category in navigate.php.

MEDIUM 45

SQL Injection vulnerability in NavigateCMS 2.9 via the URL encoded GET input category in navigate.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01465 Published 2021-06-28 No fix listed CWE-89

TI-2020-14633 CVE-2020-23657 · GHSA-mrmg-8293-p4rr

NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration."

LOW 25

NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration."

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00531 Published 2020-08-26 No fix listed CWE-79

TI-2020-14632 CVE-2020-23656 · GHSA-q65p-53px-2pgh

NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Content."

LOW 25

NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Content."

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00531 Published 2020-08-26 No fix listed CWE-79

TI-2020-14631 CVE-2020-23655 · GHSA-8j96-24wc-fp8x

NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration."

LOW 25

NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration."

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00545 Published 2020-08-26 No fix listed CWE-79

TI-2020-14630 CVE-2020-23654 · GHSA-gx33-57j8-54vm

NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) via the module "Shop."

LOW 25

NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) via the module "Shop."

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00531 Published 2020-08-26 No fix listed CWE-79

TI-2020-10983 CVE-2020-14018 · GHSA-864x-x969-pcrq

An issue was discovered in Navigate CMS 2.9 r1433.

LOW 29

An issue was discovered in Navigate CMS 2.9 r1433.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00934 Published 2020-06-24 No fix listed CWE-79

TI-2020-10982 CVE-2020-14017 · GHSA-m9vj-2gj5-69xw

An issue was discovered in Navigate CMS 2.9 r1433.

LOW 35

An issue was discovered in Navigate CMS 2.9 r1433.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01165 Published 2020-06-24 No fix listed CWE-312

TI-2020-10981 CVE-2020-14016 · GHSA-pch6-cp5c-rvh9

An issue was discovered in Navigate CMS 2.9 r1433.

LOW 27

An issue was discovered in Navigate CMS 2.9 r1433.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01579 Published 2020-06-24 No fix listed CWE-640

TI-2020-10980 CVE-2020-14015 · GHSA-9867-w377-j3vf

An issue was discovered in Navigate CMS 2.9 r1433.

LOW 36

An issue was discovered in Navigate CMS 2.9 r1433.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01361 Published 2020-06-24 No fix listed CWE-640

TI-2020-10979 CVE-2020-14014 · GHSA-f578-wpf7-xvpr

An issue was discovered in Navigate CMS 2.8 and 2.9 r1433.

LOW 25

An issue was discovered in Navigate CMS 2.8 and 2.9 r1433.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00649 Published 2020-06-24 No fix listed CWE-79

TI-2020-11738 CVE-2020-14927 · GHSA-xh9j-9cgx-45h4

Navigate CMS 2.9 allows XSS via the Alias or Real URL field of the "Web Sites > Create > Aliases > Add" screen.

LOW 23

Navigate CMS 2.9 allows XSS via the Alias or Real URL field of the "Web Sites > Create > Aliases > Add" screen.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00545 Published 2020-06-19 No fix listed CWE-79