104 matches found
CVE-2021-37477
NavigateCMS is affected by a SQL injection in structure.php (parameter: children_order) for version 2.9.4 and earlier, enabling arbitrary SQL execution in the backend. The Root Cause is a vulnerable input handling path in the structure.php function. Reported severity ranges from HIGH (CVSS v2) to...
CVE-2021-37477
In NavigateCMS version 2.9.4 and below, function in structure.php is vulnerable to sql injection on parameter childrenorder, which results in arbitrary sql query execution in the backend database...
CVE-2021-37476
NavigateCMS 2.9.4 and earlier are affected by CVE-2021-37476 due to an SQL injection in product.php where the id parameter is exploited via a POST request, enabling arbitrary SQL queries in the backend database. The vulnerability stems from improper input handling in the affected function. The pr...
CVE-2021-37476
In NavigateCMS version 2.9.4 and below, function in product.php is vulnerable to sql injection on parameter id through a post request, which results in arbitrary sql query execution in the backend database...
CVE-2021-37475
In NavigateCMS version 2.9.4 and below, function in templates.php is vulnerable to sql injection on parameter template-properties-order, which results in arbitrary sql query execution in the backend database...
CVE-2021-37475
NavigateCMS 2.9.4 and earlier are affected by an SQL injection in the template-properties-order parameter within templates.php, enabling arbitrary SQL execution in the backend database. This is the root cause described across multiple sources (CVE-2021-37475; CNVD/CNNVD entries). The vulnerabilit...
CVE-2021-37473
In NavigateCMS version 2.9.4 and below, function in product.php is vulnerable to sql injection on parameter products-order through a post request, which results in arbitrary sql query execution in the backend database...
CVE-2021-37473
NavigateCMS 2.9.4 and earlier versions contain an SQL injection in the products-order parameter processed in products.php, allowing arbitrary SQL queries in the backend database. This is documented across multiple sources (e.g., NVD, CNVD/CNNVD) with no public patch/version details provided in th...
CVE-2021-37478: Improper Neutralization of Special Elements used in an SQL Command
In NavigateCMS version 2.9.4 and below, function block is vulnerable to sql injection on parameter block-order, which results in arbitrary sql query execution in the backend database...
CVE-2021-37476: Improper Neutralization of Special Elements used in an SQL Command
In NavigateCMS version 2.9.4 and below, function in product.php is vulnerable to sql injection on parameter id through a post request, which results in arbitrary sql query execution in the backend database...
CVE-2021-37475: Improper Neutralization of Special Elements used in an SQL Command
In NavigateCMS version 2.9.4 and below, function in templates.php is vulnerable to sql injection on parameter template-properties-order, which results in arbitrary sql query execution in the backend database...
CVE-2021-37477: Improper Neutralization of Special Elements used in an SQL Command
In NavigateCMS version 2.9.4 and below, function in structure.php is vulnerable to sql injection on parameter childrenorder, which results in arbitrary sql query execution in the backend database...
CVE-2021-37473: Improper Neutralization of Special Elements used in an SQL Command
In NavigateCMS version 2.9.4 and below, function in product.php is vulnerable to sql injection on parameter products-order through a post request, which results in arbitrary sql query execution in the backend database...
CVE-2020-23243: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS vulnerability in NavigateCMS NavigateCMS 2.9 via the name="wrongpathredirect" feature...
CVE-2020-23242: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS vulnerability in NavigateCMS 2.9 when performing a Create or Edit via the Tools feature...
CVE-2020-23711
SQL Injection vulnerability in NavigateCMS 2.9 via the URL encoded GET input category in navigate.php...
CVE-2020-23711
SQL Injection vulnerability in NavigateCMS 2.9 via the URL encoded GET input category in navigate.php...
Sql injection
SQL Injection vulnerability in NavigateCMS 2.9 via the URL encoded GET input category in navigate.php...
CVE-2020-23711
NavigateCMS 2.9 is affected by CVE-2020-23711 due to a SQL injection in navigate.php: the URL GET input category is injectable. Documented risk is high (CVSS3.1 base 9.8, CRITICAL) with network access and no user interaction required. Exploitation details are not provided in the connected sources...