CVE-2020-37053

Navigate CMS 2.8.7 - ''sidx' SQL Injection

CVSS 7.1 HIGHEPSS 0.3%CWE-89

Vexday Risk Score

21Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 7.1EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

30 ene 2026Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

Navigate CMS 2.8.7 contains an authenticated SQL injection vulnerability that allows attackers to leak database information by manipulating the 'sidx' parameter in comments. Attackers can exploit the vulnerability to extract user activation keys by using time-based blind SQL injection techniques, potentially enabling password reset for administrative accounts.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Productos afectados

Naviwebs S.C. · Navigate CMS

Referencias

https://sourceforge.net/projects/navigatecms https://www.exploit-db.com/exploits/48545 https://www.navigatecms.com/en/home https://www.vulncheck.com/advisories/navigate-cms-sidx-sql-injection