{"id":"CVE-2020-37053","state":"PUBLISHED","title":"Navigate CMS 2.8.7 - ''sidx' SQL Injection","description":"Navigate CMS 2.8.7 contains an authenticated SQL injection vulnerability that allows attackers to leak database information by manipulating the 'sidx' parameter in comments. Attackers can exploit the vulnerability to extract user activation keys by using time-based blind SQL injection techniques, potentially enabling password reset for administrative accounts.","publishedAt":"2026-01-30T22:07:19.052Z","updatedAt":"2026-03-05T01:27:43.005Z","severity":{"score":7.1,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["Naviwebs S.C. Navigate CMS"],"affected":[{"vendor":"Naviwebs S.C.","product":"Navigate CMS","versions":[{"version":"2.8.7","status":"affected"}]}],"references":["https://www.exploit-db.com/exploits/48545","https://www.navigatecms.com/en/home","https://sourceforge.net/projects/navigatecms","https://www.vulncheck.com/advisories/navigate-cms-sidx-sql-injection"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-29T19:47:27.394Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2020/37xxx/CVE-2020-37053.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2020-37053","state":"PUBLISHED","datePublished":"2026-01-30T22:07:19.052Z","dateUpdated":"2026-03-05T01:27:43.005Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-01-28T18:18:30.525Z"},"containers":{"cna":{"title":"Navigate CMS 2.8.7 - ''sidx' SQL Injection","descriptions":[{"lang":"en","value":"Navigate CMS 2.8.7 contains an authenticated SQL injection vulnerability that allows attackers to leak database information by manipulating the 'sidx' parameter in comments. Attackers can exploit the vulnerability to extract user activation keys by using time-based blind SQL injection techniques, potentially enabling password reset for administrative accounts."}],"affected":[{"vendor":"Naviwebs S.C.","product":"Navigate CMS","versions":[{"version":"2.8.7","status":"affected"}]}],"references":[{"url":"https://www.exploit-db.com/exploits/48545","name":"ExploitDB-48545","tags":["exploit"]},{"url":"https://www.navigatecms.com/en/home","name":"Navigate CMS Official Homepage","tags":["product"]},{"url":"https://sourceforge.net/projects/navigatecms","name":"Navigate CMS SourceForge Page","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/navigate-cms-sidx-sql-injection","name":"VulnCheck Advisory: Navigate CMS 2.8.7 - ''sidx' SQL Injection","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":7.1,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","lang":"en","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-03-05T01:27:43.005Z"},"datePublic":"2020-06-04T00:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:naviwebs:navigate_cms:2.9.4:*:*:*:*:*:*:*"}]}]}],"credits":[{"lang":"en","value":"Gus Ralph","type":"finder"}],"x_generator":{"engine":"vulncheck"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-02-02T20:06:04.340578Z","id":"CVE-2020-37053","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-02T20:06:13.908Z"}}]}}}