Naviwebs: >> Navigate Cms Security Vulnerabilities
An issue was discovered in Navigate CMS 2.9 r1433. When performing a password reset, a user is emailed an activation code that allows them to reset their password. There is, however, a flaw when no activation code is supplied. The system will allow an unauthorized user to continue setting a password, even though no activation code was supplied, setting the password for the most recently created user in the system (the user with the highest user id).
CVSS Score
7.5
EPSS Score
0.002
Published
2020-06-24
Navigate CMS 2.9 allows XSS via the Alias or Real URL field of the "Web Sites > Create > Aliases > Add" screen.
CVSS Score
4.8
EPSS Score
0.002
Published
2020-06-19
An issue was discovered in Navigate CMS through 2.8.7. It allows Directory Traversal because lib/packages/templates/template.class.php mishandles ../ and ..\ substrings.
CVSS Score
5.3
EPSS Score
0.003
Published
2020-06-03
An issue was discovered in Navigate CMS through 2.8.7. It allows XSS because of a lack of purify calls in lib/packages/structure/structure.class.php.
CVSS Score
6.1
EPSS Score
0.002
Published
2020-06-03
An issue was discovered in Navigate CMS through 2.8.7. It allows XSS because of a lack of purify calls in lib/packages/websites/website.class.php.
CVSS Score
6.1
EPSS Score
0.002
Published
2020-06-03
An issue was discovered in Navigate CMS through 2.8.7. It allows XSS because of a lack of purify calls in lib/packages/feeds/feed.class.php.
CVSS Score
6.1
EPSS Score
0.002
Published
2020-06-03
Navigate CMS has Stored XSS via the navigate.php Title field in an edit action.
CVSS Score
5.4
EPSS Score
0.002
Published
2018-10-09
Navigate CMS 2.8 has Stored XSS via a navigate_upload.php (aka File Upload) request with a multipart/form-data JavaScript payload.
CVSS Score
5.4
EPSS Score
0.002
Published
2018-10-04
An "Unrestricted Upload of File with Dangerous Type" issue with directory traversal in navigate_upload.php in Naviwebs Navigate CMS 2.8 allows authenticated attackers to achieve remote code execution via a POST request with engine=picnik and id=../../../navigate_info.php.
CVSS Score
8.8
EPSS Score
0.806
Published
2018-10-03
SQL Injection in login.php in Naviwebs Navigate CMS 2.8 allows remote attackers to bypass authentication via the navigate-user cookie.
CVSS Score
9.8
EPSS Score
0.886
Published
2018-10-03