CVE-2020-37053 HIGH

CVE-2020-37053: Navigate CMS 2.8.7 - ''sidx' SQL Injection

Vendor Naviwebs S.c.
Product Navigate CMS
Weakness CWE-89 · SQLi
Published January 30, 2026
Last update March 5, 2026

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Navigate CMS 2.8.7 contains an authenticated SQL injection vulnerability that allows attackers to leak database information by manipulating the 'sidx' parameter in comments. Attackers can exploit the vulnerability to extract user activation keys by using time-based blind SQL injection techniques, potentially enabling password reset for administrative accounts.

Key dates

02Disclosure timeline

January 30, 2026 CVE published
March 5, 2026 Record updated