PatchTheCVEnaviwebs vulnerabilities
Recent CVEs affecting naviwebs products. 12 tracked.
naviwebs has 12 tracked vulnerabilities, 6 critical. A fixed release or vendor patch exists for 5. Most recent: 2022-04-28. Highest priority: CVE-2021-37478 (score 65/100).
- CVE-2022-28117 MEDIUM 4.9 DOWNGRADE A Server-Side Request Forgery (SSRF) in feed_parser class of Navigate CMS v2.9.4 allows remote attackers to fo
- CVE-2021-44299 MEDIUM 5.4 DOWNGRADE A reflected cross-site scripting (XSS) vulnerability in \lib\packages\themes\themes.php of Navigate CMS v2.9.4
- CVE-2021-37478 CRITICAL 9.8 UPGRADE In NavigateCMS version 2.9.4 and below, function `block` is vulnerable to sql injection on parameter `block-or
- CVE-2021-37477 CRITICAL 9.8 UPGRADE In NavigateCMS version 2.9.4 and below, function in `structure.php` is vulnerable to sql injection on paramete
- CVE-2021-37476 CRITICAL 9.8 UPGRADE In NavigateCMS version 2.9.4 and below, function in `product.php` is vulnerable to sql injection on parameter
- CVE-2021-37475 CRITICAL 9.8 UPGRADE In NavigateCMS version 2.9.4 and below, function in `templates.php` is vulnerable to sql injection on paramete
- CVE-2021-37473 CRITICAL 9.8 UPGRADE In NavigateCMS version 2.9.4 and below, function in `product.php` is vulnerable to sql injection on parameter
- CVE-2021-36455 HIGH 8.8 DOWNGRADE SQL Injection vulnerability in Naviwebs Navigate CMS 2.9 via the quicksearch parameter in \lib\packages\commen
- CVE-2021-36454 MEDIUM 5.4 DOWNGRADE Cross Site Scripting (XSS) vulnerability in Naviwebs Navigate Cms 2.9 via the navigate-quickse parameter to 1)
- CVE-2020-23711 CRITICAL 9.8 DOWNGRADE SQL Injection vulnerability in NavigateCMS 2.9 via the URL encoded GET input category in navigate.php.
- CVE-2020-23243 MEDIUM 4.8 DOWNGRADE Cross Site Scripting (XSS) vulnerability in NavigateCMS NavigateCMS 2.9 via the name="wrong_path_redirect" fea
- CVE-2020-23242 MEDIUM 4.8 DOWNGRADE Cross Site Scripting (XSS) vulnerability in NavigateCMS 2.9 when performing a Create or Edit via the Tools fea
FAQ
How do I fix naviwebs vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is naviwebs being exploited right now?
None of the tracked naviwebs CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which naviwebs CVE should I patch first?
CVE-2021-37478 currently ranks highest (65/100): In NavigateCMS version 2.9.4 and below, function `block` is vulnerable to sql injection on parameter `block-or.