CVE-2021-37475 | BDVDB-2026-157692 Detail

Description#

In NavigateCMS version 2.9.4 and below, function in `templates.php` is vulnerable to sql injection on parameter `template-properties-order`, which results in arbitrary sql query execution in the backend database.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://gist.github.com/victomteng1997/ed429fed7de46651c89f05e7591fd4fe
https://github.com/NavigateCMS/Navigate-CMS
https://github.com/NavigateCMS/Navigate-CMS/issues/26

Exploit#

No public exploit known

History#

Version 12021-07-26Record published in the CVE List.
Version 22024-08-04Most recent update recorded in the CVE List.