CVE-2020-37053

7.1 highEPSS 0.4%

High (7.1) in naviwebs navigate cms. EPSS 0.4% chance of exploitation in the next 30 days.

Navigate CMS 2.8.7 contains an authenticated SQL injection vulnerability that allows attackers to leak database information by manipulating the 'sidx' parameter in comments. Attackers can exploit the vulnerability to extract user activation keys by using time-based blind SQL injection techniques, potentially enabling password reset for administrative accounts.

Severity

CVSS 4.0

7.1 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 31% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2026-01-30
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

naviwebs:navigate_cms

References

https://sourceforge.net/projects/navigatecms
https://www.exploit-db.com/exploits/48545
https://www.navigatecms.com/en/home
https://www.vulncheck.com/advisories/navigate-cms-sidx-sql-injection

Check your stack JSON