CVE-2021-36454 - CVE House

Back to Database

Status published Medium CVE-2021-36454

Cross Site Scripting (XSS) vulnerability in Naviwebs Navigate Cms 2.9...

5.4 CVSS

Vulnerability Description

Cross Site Scripting (XSS) vulnerability in Naviwebs Navigate Cms 2.9 via the navigate-quickse parameter to 1) backups\backups.php, 2) blocks\blocks.php, 3) brands\brands.php, 4) comments\comments.php, 5) coupons\coupons.php, 6) feeds\feeds.php, 7) functions\functions.php, 8) items\items.php, 9) menus\menus.php, 10) orders\orders.php, 11) payment_methods\payment_methods.php, 12) products\products.php, 13) profiles\profiles.php, 14) shipping_methods\shipping_methods.php, 15) templates\templates.php, 16) users\users.php, 17) webdictionary\webdictionary.php, 18) websites\websites.php, and 19) webusers\webusers.php because the initial_url function is built in these files.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-36454

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from naviwebs

View All →

A Server-Side Request Forgery (SSRF) in feed_parser class of Navigate...

An arbitrary file read vulnerability exists in NavigateCMS 2.9 via...

A reflected cross-site scripting (XSS) vulnerability in \lib\packages\themes\themes.php of Navigate...

In NavigateCMS version 2.9.4 and below, function `block` is vulnerable...

In NavigateCMS version 2.9.4 and below, function in `structure.php` is...

Affected Vendor

naviwebs

View all reports →

Affected Software

navigate cms

Vulnerable Versions:

2.9

Timeline

Official Publish: August 6th, 2021

Last Modified: August 4th, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.