Design/Logic Flaw

An "Unrestricted Upload of File with Dangerous Type" issue with directory traversal in navigateupload.php in Naviwebs Navigate CMS 2.8 allows authenticated attackers to achieve remote code execution via a POST request with engine=picnik and id=../../../navigateinfo.php...

CVE-2018-17552

Navigate CMS 2.8 is affected by multiple vulnerabilities described across connected sources. The core CVE-2018-17552 issue is a SQL Injection in login.php that allows bypassing authentication via the navigate-user cookie. Additionally, related sources describe an unauthenticated remote code execu...

CVE-2018-17552

SQL Injection in login.php in Naviwebs Navigate CMS 2.8 allows remote attackers to bypass authentication via the navigate-user cookie...

CVE-2018-17553

Navigate CMS 2.8 is affected by CVE-2018-17553 via a directory traversal in navigate_upload.php that enables Unrestricted Upload of File with Dangerous Type, allowing remote code execution after an authenticated POST (engine=picnik, id=../../../navigate_info.php). Public references show an unauth...

CVE-2018-17552: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection in login.php in Naviwebs Navigate CMS 2.8 allows remote attackers to bypass authentication via the navigate-user cookie...

CVE-2018-17553: Improper Limitation of a Pathname to a Restricted Directory

An "Unrestricted Upload of File with Dangerous Type" issue with directory traversal in navigateupload.php in Naviwebs Navigate CMS 2.8 allows authenticated attackers to achieve remote code execution via a POST request with engine=picnik and id=../../../navigateinfo.php...

Microsoft Office: Navigate URL

This test checks the setting for policy OpenVAS Vulnerability Test $Id: officenavigateurl.nasl 11843 2018-10-11 14:33:21Z emoss $ Check value for Navigate URL Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can...

Navigate CMS Unauthenticated Remote Code Execution

This module exploits insufficient sanitization in the database::protect method, of Navigate CMS versions 2.8 and prior, to bypass authentication. The module then uses a path traversal vulnerability in navigateupload.php that allows authenticated users to upload PHP files to arbitrary locations...

Navigate CMS 2.8 Cross Site Scripting

Title: Navigate CMS 2.8 - Cross-Site Scripting Author: Felipe "Renzi" Gabriel Date: 2018-09-19 Vendor: https://www.navigatecms.com/en/home Software: Navigate CMS 2.8 CVE: CVE-2018-17255 Technical Details & Description: A Reflected Cross-Site Scripting web vulnerability has been discovered in the...

Navigate CMS Cross-Site Scripting Vulnerability

Navigate CMS is an open source content management system CMS. A cross-site scripting vulnerability exists in the 'fid' parameter of the navigate.php file in Navigate CMS version 2.8, which can be exploited by remote attackers to inject arbitrary web script or HTML...

Navigate CMS 2.8 - Cross-Site Scripting

Navigate CMS 2.8 - Cross-Site Scripting Title: Navigate CMS 2.8 - Cross-Site Scripting Author: Felipe "Renzi" Gabriel Date: 2018-09-19 Vendor: https://www.navigatecms.com/en/home Software: Navigate CMS 2.8 CVE: CVE-2018-17255 Technical Details & Description: A Reflected Cross-Site Scripting web...

Navigate CMS 2.8 - Cross-Site Scripting

Title: Navigate CMS 2.8 - Cross-Site Scripting Author: Felipe "Renzi" Gabriel Date: 2018-09-19 Vendor: https://www.navigatecms.com/en/home Software: Navigate CMS 2.8 CVE: CVE-2018-17255 Technical Details & Description: A Reflected Cross-Site Scripting web vulnerability has been discovered in the...

Navigate CMS 2.8 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Title: Navigate CMS 2.8 - Cross-Site Scripting Author: Felipe "Renzi" Gabriel Vendor: https://www.navigatecms.com/en/home Software: Navigate CMS 2.8 CVE: CVE-2018-17255 Technical Details & Description: A Reflected Cross-Site Scripting web...

navigatecms.com XSS vulnerability

Open Bug Bounty ID: OBB-677797 Description| Value ---|--- Affected Website:| navigatecms.com Open Bug Bounty Program:| View Open Bug Bounty Program Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

ROUTE 66 Navigate - WebView SSL handling enabled, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application ROUTE 66 Navigate published at the 'play' market has multiple vulnerabilities...

Drupal Navigate module cross-site scripting vulnerability (CNVD-2015-05492)

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Navigate is one of the customizable navigation modules that supports rapid deployment. A cross-site scripting vulnerability exists in the Drupal Navigate module. A remote attacker can...

CVE-2015-5500

Cross-site scripting XSS vulnerability in the Navigate module for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Navigate module for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-5499

The Navigate module for Drupal does not properly check permissions, which allows remote authenticated users to modify custom widgets and create widget database records by leveraging the "navigate view" permission...

Code injection

The Navigate module for Drupal does not properly check permissions, which allows remote authenticated users to modify custom widgets and create widget database records by leveraging the "navigate view" permission...