Naviwebs vulnerabilities
Published CVEs affecting Naviwebs products: 2 record(s), with severity, exploitation and fixes.
CVE-2020-37054
High · 8.8
CWE-352 Jan 30, 2026
Navigate CMS 2.8.7 - Cross-Site Request Forgery
Navigate CMS 2.8.7 contains a cross-site request forgery vulnerability that allows attackers to upload malicious extensions through a crafted HTML page. Attackers can trick authenticated administrators into executing arbitrary file uploads by leveraging the extension upload functionality without additional validation.
CVE-2020-37053
Medium · 6.5
CWE-89 Jan 30, 2026
Navigate CMS 2.8.7 - ''sidx' SQL Injection
Navigate CMS 2.8.7 contains an authenticated SQL injection vulnerability that allows attackers to leak database information by manipulating the 'sidx' parameter in comments. Attackers can exploit the vulnerability to extract user activation keys by using time-based blind SQL injection techniques, potentially enabling password reset for administrative accounts.