CVE-2021-37476: Improper Neutralization of Special Elements used in an SQL Command

In NavigateCMS version 2.9.4 and below, function in product.php is vulnerable to sql injection on parameter id through a post request, which results in arbitrary sql query execution in the backend database...

CVE-2021-37473: Improper Neutralization of Special Elements used in an SQL Command

In NavigateCMS version 2.9.4 and below, function in product.php is vulnerable to sql injection on parameter products-order through a post request, which results in arbitrary sql query execution in the backend database...