CVE-2020-37054: Naviwebs Navigate CMS

High severity, CVSS 8.8. EPSS: 0.2% chance of exploitation in the next 30 days.

Navigate CMS 2.8.7 contains a cross-site request forgery vulnerability that allows attackers to upload malicious extensions through a crafted HTML page. Attackers can trick authenticated administrators into executing arbitrary file uploads by leveraging the extension upload functionality without additional validation.

Affected products

• Naviwebs Navigate CMS: version 2.8.7 only

Published 2026-01-30. Last modified 2026-06-17.