CVE-2021-37475

In NavigateCMS version 2.9.4 and below, function in "templates.php" is vulnerable to sql injection on parameter "template-properties-order", which results in arbitrary sql query execution in the backend database...

CVE-2021-37473

In NavigateCMS version 2.9.4 and below, function in "product.php" is vulnerable to sql injection on parameter "products-order" through a post request, which results in arbitrary sql query execution in the backend database...

CVE-2021-37473: Improper Neutralization of Special Elements used in an SQL Command

In NavigateCMS version 2.9.4 and below, function in product.php is vulnerable to sql injection on parameter products-order through a post request, which results in arbitrary sql query execution in the backend database...

CVE-2021-37476: Improper Neutralization of Special Elements used in an SQL Command

In NavigateCMS version 2.9.4 and below, function in product.php is vulnerable to sql injection on parameter id through a post request, which results in arbitrary sql query execution in the backend database...