Vulnerabilities > Naviwebs > High
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-07-26 | CVE-2021-37473 | SQL Injection vulnerability in Naviwebs Navigatecms 2.9 In NavigateCMS version 2.9.4 and below, function in `product.php` is vulnerable to sql injection on parameter `products-order` through a post request, which results in arbitrary sql query execution in the backend database. | 7.5 |
| 2021-07-26 | CVE-2021-37475 | SQL Injection vulnerability in Naviwebs Navigatecms 2.9 In NavigateCMS version 2.9.4 and below, function in `templates.php` is vulnerable to sql injection on parameter `template-properties-order`, which results in arbitrary sql query execution in the backend database. | 7.5 |
| 2021-07-26 | CVE-2021-37476 | SQL Injection vulnerability in Naviwebs Navigatecms 2.9 In NavigateCMS version 2.9.4 and below, function in `product.php` is vulnerable to sql injection on parameter `id` through a post request, which results in arbitrary sql query execution in the backend database. | 7.5 |
| 2021-07-26 | CVE-2021-37477 | SQL Injection vulnerability in Naviwebs Navigatecms 2.9 In NavigateCMS version 2.9.4 and below, function in `structure.php` is vulnerable to sql injection on parameter `children_order`, which results in arbitrary sql query execution in the backend database. | 7.5 |
| 2021-07-26 | CVE-2021-37478 | SQL Injection vulnerability in Naviwebs Navigatecms 2.9 In NavigateCMS version 2.9.4 and below, function `block` is vulnerable to sql injection on parameter `block-order`, which results in arbitrary sql query execution in the backend database. | 7.5 |
| 2021-06-28 | CVE-2020-23711 | SQL Injection vulnerability in Naviwebs Navigate CMS 2.9 SQL Injection vulnerability in NavigateCMS 2.9 via the URL encoded GET input category in navigate.php. | 7.5 |
| 2020-06-15 | CVE-2020-14067 | Unrestricted Upload of File with Dangerous Type vulnerability in Naviwebs Navigatecms 2.9 The install_from_hash functionality in Navigate CMS 2.9 does not consider the .phtml extension when examining files within a ZIP archive that may contain PHP code, in check_upload in lib/packages/extensions/extension.class.php and lib/packages/themes/theme.class.php. | 7.5 |
| 2018-10-03 | CVE-2018-17552 | SQL Injection vulnerability in Naviwebs Navigate CMS 2.8 SQL Injection in login.php in Naviwebs Navigate CMS 2.8 allows remote attackers to bypass authentication via the navigate-user cookie. | 7.5 |