CVE-2020-37054

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Navigate CMS 2.8.7 contains a cross-site request forgery vulnerability that allows attackers to upload malicious extensions through a crafted HTML page. Attackers can trick authenticated administrators into executing arbitrary file uploads by leveraging the extension upload functionality without additional validation.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Naviwebs S.C.	Navigate CMS	2.8.7

References

https://sourceforge.net/projects/navigatecmsProduct
https://www.exploit-db.com/exploits/48548Exploit, Third Party Advisory, VDB Entry
https://www.navigatecms.com/en/homeProduct
https://www.vulncheck.com/advisories/navigate-cms-cross-site-request-forgeryBroken Link

Timeline

Published: Jan 30, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2020

CVE-2020-370557.8SpyHunter 4 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated syst CVE-2020-370569.8Crystal Shard http-protection 0.2.0 contains an IP spoofing vulnerability that allows attackers to bypass protection middleware by manipulat CVE-2020-370579.8Online-Exam-System 2015 contains a SQL injection vulnerability in the feedback module that allows attackers to manipulate database queries t CVE-2020-370587.8Andrea ST Filters Service 1.0.64.7 contains an unquoted service path vulnerability in its Windows service configuration. Local attackers can CVE-2020-370597.8Popcorn Time 6.2.1.14 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code wit CVE-2020-370607.8Atomic Alarm Clock 6.3 contains a local privilege escalation vulnerability in its service configuration that allows attackers to execute arb CVE-2020-370617.8BOOTP Turbo 2.0.1214 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with CVE-2020-370627.8DHCP Turbo 4.61298 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code by expl CVE-2020-370637.8TFTP Turbo 4.6.1273 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with e CVE-2020-370647.8EPSON EasyMP Network Projection 2.81 contains an unquoted service path vulnerability in the EMP_NSWLSV service that allows local users to po CVE-2020-370659.8StreamRipper32 version 2.6 contains a buffer overflow vulnerability in the Station/Song Section that allows attackers to overwrite memory by CVE-2020-370669.8GoldWave 5.70 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by crafting malicious input in the Fi