CVE-2020-37053

HighPublic PoC

Published: 30 January 2026

Published

30 January 2026

Modified

13 February 2026

KEV Added

—

Patch

—

CVSS Score 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

EPSS Score 0.0001 2.8th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2020-37053 is a high-severity SQL Injection (CWE-89) vulnerability in Naviwebs Navigate Cms. Its CVSS base score is 7.1 (High).

Operationally, ranked at the 2.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CA-8 Penetration Testing

addresses: CWE-89

Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

SI-10 Information Input Validation

addresses: CWE-89

Validates query inputs to prevent SQL syntax or command manipulation.

NVD Description

Navigate CMS 2.8.7 contains an authenticated SQL injection vulnerability that allows attackers to leak database information by manipulating the 'sidx' parameter in comments. Attackers can exploit the vulnerability to extract user activation keys by using time-based blind SQL injection techniques,…

potentially enabling password reset for administrative accounts.

Deeper analysisAI

Navigate CMS version 2.8.7 is affected by CVE-2020-37053, an authenticated SQL injection vulnerability (CWE-89) in the 'sidx' parameter within the comments functionality. This flaw allows attackers to manipulate the parameter to leak database information through time-based blind SQL injection techniques. The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), indicating high confidentiality impact with low privileges required.

Authenticated users with low privileges (PR:L) can exploit this vulnerability remotely over the network with low complexity and no user interaction. Successful exploitation enables extraction of sensitive database contents, such as user activation keys, which could facilitate password resets for administrative accounts, potentially leading to unauthorized account takeover.

Advisories and references, including those from VulnCheck and an Exploit-DB entry (exploit 48545), detail the issue; security practitioners should consult these for patch information or upgrade guidance from the Navigate CMS project on SourceForge or its official site. No specific mitigation steps are outlined in the core CVE details.