CVE-2020-37053
Navigate CMS 2.8.7 - ''sidx' SQL Injection
- State
- Published
- Severity
- 7.1 High
- Published
- Jan 30, 2026
- Updated
- Mar 5, 2026
- Reserved
- Jan 28, 2026
Description
Navigate CMS 2.8.7 contains an authenticated SQL injection vulnerability that allows attackers to leak database information by manipulating the 'sidx' parameter in comments. Attackers can exploit the vulnerability to extract user activation keys by using time-based blind SQL injection techniques, potentially enabling password reset for administrative accounts.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.1 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N | VulnCheck |
Weaknesses
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected Products
| Product | Versions |
|---|---|
Navigate CMSNaviwebs S.C. |
|
References
- ExploitDB-48545exploit
- Navigate CMS Official Homepageproduct
- Navigate CMS SourceForge Pageproduct
- VulnCheck Advisory: Navigate CMS 2.8.7 - ''sidx' SQL Injectionthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.