CVE-2021-37478

Name of the Vulnerable Software and Affected Versions NavigateCMS versions 2.9.4 and below

Description The issue concerns a sql injection vulnerability in the block function, specifically affecting the block-order parameter. This vulnerability allows for the execution of arbitrary sql queries in the backend database.

Recommendations For NavigateCMS versions 2.9.4 and below, consider disabling the block function until a patch is available to prevent exploitation of the sql injection vulnerability. Restrict access to the block-order parameter to minimize the risk of arbitrary sql query execution.