Strapi vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
40 matching records
- High8.8An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file.Check if you run itEPSS 1.97%Jul 13, 2022
- Medium4.8Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function.Check if you run itEPSS 0.78%Jun 13, 2022
- High7.5An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if content type…Check if you run itEPSS 0.96%May 19, 2022
- High8.8An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel users t…Check if you run itEPSS 1.47%May 19, 2022
- High7.5Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an attacker to access a victim's HTT…Check if you run itEPSS 2.88%May 3, 2022
- Critical9.8An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file.Check if you run itEPSS 3.22%Apr 12, 2022
- Medium6.7Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0.Check if you run itEPSS 0.73%Feb 26, 2022
- High8.1In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password.Check if you run itEPSS 1.28%May 6, 2021
- Medium5.4Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature.Check if you run itEPSS 0.71%Oct 22, 2020
- High7.5In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB (aka content-type-builder) routes.Check if you run itEPSS 1.21%Oct 22, 2020
- Critical9.8admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality.Check if you run itEPSS 2.29%Oct 22, 2020
- Medium6.5Strapi before 3.0.2 could allow a remote authenticated attacker to bypass security restrictions because templates are stored in a global variable without any sanitation.Check if you run itEPSS 1.67%Jun 19, 2020
- Medium4.9A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary restart of the application.Check if you run itEPSS 1.15%Feb 4, 2020
- High7.2Strapi Strapi Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Patch nowKEVEPSS 54.08%Dec 5, 2019
- Critical9.8Strapi Strapi Weak Password Recovery Mechanism for Forgotten PasswordPatch nowKEVEPSS 97.64%Nov 7, 2019