PatchTheCVEnavigatecms vulnerabilities and fixes
Recent CVEs affecting navigatecms, with upgrade or downgrade steps. 12 tracked.
navigatecms has 12 tracked vulnerabilities, 6 critical. A fixed release or vendor patch exists for 5. Most recent: 2021-07-26. Highest priority: CVE-2021-37478 (score 65/100).
- CVE-2021-37478 CRITICAL 9.8 UPGRADE In NavigateCMS version 2.9.4 and below, function `block` is vulnerable to sql injection on parameter `block-or
- CVE-2021-37477 CRITICAL 9.8 UPGRADE In NavigateCMS version 2.9.4 and below, function in `structure.php` is vulnerable to sql injection on paramete
- CVE-2021-37476 CRITICAL 9.8 UPGRADE In NavigateCMS version 2.9.4 and below, function in `product.php` is vulnerable to sql injection on parameter
- CVE-2021-37475 CRITICAL 9.8 UPGRADE In NavigateCMS version 2.9.4 and below, function in `templates.php` is vulnerable to sql injection on paramete
- CVE-2021-37473 CRITICAL 9.8 UPGRADE In NavigateCMS version 2.9.4 and below, function in `product.php` is vulnerable to sql injection on parameter
- CVE-2020-23657 MEDIUM 5.4 DOWNGRADE NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration."
- CVE-2020-23656 MEDIUM 5.4 DOWNGRADE NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Content."
- CVE-2020-23655 MEDIUM 5.4 DOWNGRADE NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration."
- CVE-2020-23654 MEDIUM 5.4 DOWNGRADE NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) via the module "Shop."
- CVE-2020-23243 MEDIUM 4.8 DOWNGRADE Cross Site Scripting (XSS) vulnerability in NavigateCMS NavigateCMS 2.9 via the name="wrong_path_redirect" fea
- CVE-2020-23242 MEDIUM 4.8 DOWNGRADE Cross Site Scripting (XSS) vulnerability in NavigateCMS 2.9 when performing a Create or Edit via the Tools fea
- CVE-2020-14067 CRITICAL 9.8 DOWNGRADE The install_from_hash functionality in Navigate CMS 2.9 does not consider the .phtml extension when examining
FAQ
How do I fix navigatecms vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is navigatecms being exploited right now?
None of the tracked navigatecms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which navigatecms CVE should I patch first?
CVE-2021-37478 currently ranks highest (65/100): In NavigateCMS version 2.9.4 and below, function `block` is vulnerable to sql injection on parameter `block-or.