Vulnerability · Published Jan 30, 2026 · Assigned by VulnCheck
CVE-2020-37053Navigate CMS 2.8.7 - ''sidx' SQL Injection
High 7.1
In plain English
A high-severity SQL injection in Navigate CMS from Naviwebs S.C.. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.4%top 68.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Navigate CMS 2.8.7 contains an authenticated SQL injection vulnerability that allows attackers to leak database information by manipulating the 'sidx' parameter in comments. Attackers can exploit the vulnerability to extract user activation keys by using time-based blind SQL injection techniques, potentially enabling password reset for administrative accounts.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Naviwebs S.C. | Navigate CMS | 2.8.7 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
References
- ExploitDB-48545 exploit
- Navigate CMS Official Homepage product
- Navigate CMS SourceForge Page product
- VulnCheck Advisory: Navigate CMS 2.8.7 - ''sidx' SQL Injection third-party-advisory