CVE-2020-37053

Navigate CMS 2.8.7 - ''sidx' SQL Injection

High7.1Public exploitEPSS 0.38%

Published: 30 Jan 2026
Updated: 5 Mar 2026
Reserved: 28 Jan 2026
Assigned by: VulnCheck

Description

Navigate CMS 2.8.7 contains an authenticated SQL injection vulnerability that allows attackers to leak database information by manipulating the 'sidx' parameter in comments. Attackers can exploit the vulnerability to extract user activation keys by using time-based blind SQL injection techniques, potentially enabling password reset for administrative accounts.

Public exploit

A reference of the record is tagged as an exploit or proof of concept: anyone can try it against an unpatched system. CISA's SSVC rates its exploitation: a proof of concept is public.

ExploitDB-48545 (opens in a new tab)exploit

Timeline

2026
28 Jan 2026
28 Jan 2026
ID reserved
By VulnCheck
30 Jan 20262 days later
30 Jan 2026· 2 days later
Published
5 Mar 202634 days later
5 Mar 2026· 34 days later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2020-37053, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	High7.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
VulnCheckCNA (assigner)	3.1	High7.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
NVDNVD · Analyzed	4.0	High7.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.38% · top 68% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.1.

Weakness

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (opens in a new tab)All about CWE-89 and its CVEs

Affected products

Naviwebs S.C. · Navigate CMS
- affected 2.8.7

References (4)

ExploitDB-48545 (opens in a new tab)exploit
Navigate CMS Official Homepage (opens in a new tab)product
Navigate CMS SourceForge Page (opens in a new tab)product
VulnCheck Advisory: Navigate CMS 2.8.7 - ''sidx' SQL Injection (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2020-37053](https://trackcve.app/badge/CVE-2020-37053.svg)](https://trackcve.app/cve/CVE-2020-37053)

Record last updated 5 Mar 2026, 01:27 UTC.