CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 28/04/2022 |
| CVE-2021-44299 | 中危5.4 | A reflected cross-site scripting (XSS) vulnerability in \lib\packages\themes\themes.php of Navigate CMS v2.9.4 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload. | 19/01/2022 |
| CVE-2021-44351 | 高危7.5 | An arbitrary file read vulnerability exists in NavigateCMS 2.9 via /navigate/navigate_download.php id parameter. | 06/01/2022 |
| CVE-2021-36455 | 高危8.8 | SQL Injection vulnerability in Naviwebs Navigate CMS 2.9 via the quicksearch parameter in \lib\packages\comments\comments.php. | 06/08/2021 |
| CVE-2021-36454 | 中危5.4 | Cross Site Scripting (XSS) vulnerability in Naviwebs Navigate Cms 2.9 via the navigate-quickse parameter to 1) backups\backups.php, 2) blocks\blocks.php, 3) brands\brands.php, 4) comments\comments.php, 5) coupons\coupons.php, 6) feeds\feeds.php, 7) functions\functions.php, 8) items\items.php, 9) menus\menus.php, 10) or | 06/08/2021 |
| CVE-2020-23243 | 中危4.8 | Cross Site Scripting (XSS) vulnerability in NavigateCMS NavigateCMS 2.9 via the name="wrong_path_redirect" feature. | 26/07/2021 |
| CVE-2020-23242 | 中危4.8 | Cross Site Scripting (XSS) vulnerability in NavigateCMS 2.9 when performing a Create or Edit via the Tools feature. | 26/07/2021 |
| CVE-2021-37478 | 严重9.8 | In NavigateCMS version 2.9.4 and below, function `block` is vulnerable to sql injection on parameter `block-order`, which results in arbitrary sql query execution in the backend database. | 26/07/2021 |
| CVE-2021-37477 | 严重9.8 | In NavigateCMS version 2.9.4 and below, function in `structure.php` is vulnerable to sql injection on parameter `children_order`, which results in arbitrary sql query execution in the backend database. | 26/07/2021 |
| CVE-2021-37476 | 严重9.8 | In NavigateCMS version 2.9.4 and below, function in `product.php` is vulnerable to sql injection on parameter `id` through a post request, which results in arbitrary sql query execution in the backend database. | 26/07/2021 |
| CVE-2021-37475 | 严重9.8 | In NavigateCMS version 2.9.4 and below, function in `templates.php` is vulnerable to sql injection on parameter `template-properties-order`, which results in arbitrary sql query execution in the backend database. | 26/07/2021 |
| CVE-2021-37473 | 严重9.8 | In NavigateCMS version 2.9.4 and below, function in `product.php` is vulnerable to sql injection on parameter `products-order` through a post request, which results in arbitrary sql query execution in the backend database. | 26/07/2021 |
| CVE-2020-23711 | 严重9.8 | SQL Injection vulnerability in NavigateCMS 2.9 via the URL encoded GET input category in navigate.php. | 28/06/2021 |
| CVE-2020-23657 | 中危5.4 | NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration." | 26/08/2020 |
| CVE-2020-23656 | 中危5.4 | NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Content." | 26/08/2020 |
| CVE-2020-23655 | 中危5.4 | NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration." | 26/08/2020 |
| CVE-2020-23654 | 中危5.4 | NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) via the module "Shop." | 26/08/2020 |
| CVE-2020-14018 | 中危6.1 | An issue was discovered in Navigate CMS 2.9 r1433. There is a stored XSS vulnerability that is executed on the page to view users, and on the page to edit users. This is present in both the User field and the E-Mail field. On the Edit user page, the XSS is only triggered via the E-Mail field; however, on the View user | 24/06/2020 |