Navigate Cms@2.8 Security Vulnerabilities and Issues — Navigate Cms@2.8 CVE List

Lucene search

NaviwebsNavigate Cms2.8

4 matches found

CVE•added 2018/10/03 8:29 p.m.•66 views

CVE-2018-17552

SQL Injection in login.php in Naviwebs Navigate CMS 2.8 allows remote attackers to bypass authentication via the navigate-user cookie.

9.8CVSS10AI score0.88562EPSS

CVE•added 2018/10/03 8:29 p.m.•60 views

CVE-2018-17553

An "Unrestricted Upload of File with Dangerous Type" issue with directory traversal in navigate_upload.php in Naviwebs Navigate CMS 2.8 allows authenticated attackers to achieve remote code execution via a POST request with engine=picnik and id=../../../navigate_info.php.

8.8CVSS8.8AI score0.80455EPSS

CVE•added 2020/06/24 3:15 p.m.•37 views

CVE-2020-14014

An issue was discovered in Navigate CMS 2.8 and 2.9 r1433. The query parameter fid on the resource navigate.php does not perform sufficient data validation and/or encoding, making it vulnerable to reflected XSS.

5.4CVSS5.5AI score0.00206EPSS

CVE•added 2018/10/04 9:29 p.m.•33 views

CVE-2018-17849

Navigate CMS 2.8 has Stored XSS via a navigate_upload.php (aka File Upload) request with a multipart/form-data JavaScript payload.

5.4CVSS5.1AI score0.00206EPSS