GCVE - cpe:2.3:a:naviwebs:navigate_cms:2.9:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:naviwebs:navigate_cms:2.9:*:*:*:*:*:*:*

part: a version: 2.9 update: *

Vendor	Naviwebs (`118bae96-31c7-5625-9ef7-bd28722d99eb`)
Product	Navigate Cms (`3b8ebbd3-1809-5bed-abe2-d2e316c61c71`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/navigatecms/navigate-cms`	purl2cpe	2026-06-01 10:11:18.855340
`pkg:sourceforge/navigatecms`	purl2cpe	2026-06-01 10:11:18.855341

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2021-44351`	vulnerable	2026-06-08 05:36:45.681390	Details available An arbitrary file read vulnerability exists in NavigateCMS 2.9 via /navigate/navigate_download.php id parameter. Published: 2022-01-06T11:37:24.000Z Updated: 2024-08-04T04:17:24.903Z Open on db.gcve.eu Reference links https://github.com/NavigateCMS/Navigate-CMS/issues/28	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-36455`	vulnerable	2026-06-08 05:32:52.229760	Details available SQL Injection vulnerability in Naviwebs Navigate CMS 2.9 via the quicksearch parameter in \lib\packages\comments\comments.php. Published: 2021-08-06T15:25:39.000Z Updated: 2024-08-04T00:54:51.587Z Open on db.gcve.eu Reference links https://github.com/NavigateCMS/Navigate-CMS/issues/25 https://www.navigatecms.com/en/blog/development/navigate_cms_update_2_9_4	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-36454`	vulnerable	2026-06-08 05:32:52.229258	Details available Cross Site Scripting (XSS) vulnerability in Naviwebs Navigate Cms 2.9 via the navigate-quickse parameter to 1) backups\backups.php, 2) blocks\blocks.php, 3) brands\brands.php, 4) comments\comments.php, 5) coupons\coupons.php, 6) feeds\feeds.php, 7) functions\functions.php, 8) items\items.php, 9) menus\menus.php, 10) orders\orders.php, 11) payment_methods\payment_methods.php, 12) products\products.php, 13) profiles\profiles.php, 14) shipping_methods\shipping_methods.php, 15) templates\templates.php, 16) users\users.php, 17) webdictionary\webdictionary.php, 18) websites\websites.php, and 19) webusers\webusers.php because the initial_url function is built in these files. Published: 2021-08-06T15:19:01.000Z Updated: 2024-08-04T00:54:51.489Z Open on db.gcve.eu Reference links https://github.com/NavigateCMS/Navigate-CMS/issues/24 https://www.navigatecms.com/en/blog/development/navigate_cms_update_2_9_4	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-23711`	vulnerable	2026-06-08 05:22:32.065132	Details available SQL Injection vulnerability in NavigateCMS 2.9 via the URL encoded GET input category in navigate.php. Published: 2021-06-28T16:07:26.000Z Updated: 2024-08-04T15:05:11.170Z Open on db.gcve.eu Reference links https://github.com/NavigateCMS/Navigate-CMS/issues/20	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-14927`	vulnerable	2026-06-08 05:19:24.992576	Details available Navigate CMS 2.9 allows XSS via the Alias or Real URL field of the "Web Sites > Create > Aliases > Add" screen. Published: 2020-06-19T17:02:54.000Z Updated: 2024-08-04T13:00:52.038Z Open on db.gcve.eu Reference links https://github.com/NavigateCMS/Navigate-CMS/issues/19	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.