Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Perimeter Scanner
Scanning
Projects
Scanner
Agent Scanning
API Scanning
Manual Audit
Email
Webhook
Resources
Documents
Blog
Glossary
FAQ
Plugins
Pricing
Contacts
About Us
Partners
Branding Guideline
Settings
Sign in
NaviwebsNavigatecms

12 matches found

CVE
CVE•added 2020/06/15 1:15 a.m.•53 views

CVE-2020-14067

The install_from_hash functionality in Navigate CMS 2.9 does not consider the .phtml extension when examining files within a ZIP archive that may contain PHP code, in check_upload in lib/packages/extensions/extension.class.php and lib/packages/themes/theme.class.php.

9.8CVSS9.4AI score0.00433EPSS
CVE
CVE•added 2021/07/26 9:15 p.m.•42 views

CVE-2020-23242

Cross Site Scripting (XSS) vulnerability in NavigateCMS 2.9 when performing a Create or Edit via the Tools feature.

4.8CVSS4.9AI score0.0029EPSS
CVE
CVE•added 2021/07/26 9:15 p.m.•41 views

CVE-2020-23243

Cross Site Scripting (XSS) vulnerability in NavigateCMS NavigateCMS 2.9 via the name="wrong_path_redirect" feature.

4.8CVSS4.9AI score0.00212EPSS
CVE
CVE•added 2021/07/26 6:15 p.m.•41 views

CVE-2021-37478

In NavigateCMS version 2.9.4 and below, function block is vulnerable to sql injection on parameter block-order, which results in arbitrary sql query execution in the backend database.

9.8CVSS9.6AI score0.00679EPSS
CVE
CVE•added 2021/07/26 6:15 p.m.•40 views

CVE-2021-37475

In NavigateCMS version 2.9.4 and below, function in templates.php is vulnerable to sql injection on parameter template-properties-order, which results in arbitrary sql query execution in the backend database.

9.8CVSS9.6AI score0.00679EPSS
CVE
CVE•added 2021/07/26 6:15 p.m.•35 views

CVE-2021-37473

In NavigateCMS version 2.9.4 and below, function in product.php is vulnerable to sql injection on parameter products-order through a post request, which results in arbitrary sql query execution in the backend database.

9.8CVSS9.6AI score0.00679EPSS
CVE
CVE•added 2021/07/26 6:15 p.m.•35 views

CVE-2021-37477

In NavigateCMS version 2.9.4 and below, function in structure.php is vulnerable to sql injection on parameter children_order, which results in arbitrary sql query execution in the backend database.

9.8CVSS9.6AI score0.00679EPSS
CVE
CVE•added 2021/07/26 6:15 p.m.•32 views

CVE-2021-37476

In NavigateCMS version 2.9.4 and below, function in product.php is vulnerable to sql injection on parameter id through a post request, which results in arbitrary sql query execution in the backend database.

9.8CVSS9.6AI score0.00679EPSS
CVE
CVE•added 2020/08/26 5:15 p.m.•31 views

CVE-2020-23655

NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration."

5.4CVSS5.3AI score0.00206EPSS
CVE
CVE•added 2020/08/26 5:15 p.m.•28 views

CVE-2020-23657

NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration."

5.4CVSS5.3AI score0.00206EPSS
CVE
CVE•added 2020/08/26 5:15 p.m.•27 views

CVE-2020-23654

NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) via the module "Shop."

5.4CVSS5.3AI score0.00206EPSS
CVE
CVE•added 2020/08/26 5:15 p.m.•27 views

CVE-2020-23656

NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Content."

5.4CVSS5.3AI score0.00206EPSS