Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Settings
Sign in

CVE-2019-18818

🗓️ 07 Nov 2019 21:02:58Reported by mitreType 
cve
 cve🔗 web.nvd.nist.gov👁 434 Views🌐 WEB

Strapi < 3.0.0-beta.17.5 mishandles password resets

Related
Detection
Refs
Paths
ReporterTitlePublishedViews
Family
zdt
zdt		Strapi 3.0.0-beta - Set Password (Unauthenticated) Exploit
30 Aug 202100:00
–zdt
zdt
zdt		Strapi CMS 3.0.0-beta.17.4 - Remote Code Execution (Unauthenticated) Exploit
30 Aug 202100:00
–zdt
zdt
zdt		Strapi CMS 3.0.0-beta.17.4 - Set Password (Unauthenticated) Exploit
8 Feb 202200:00
–zdt
githubexploit
GithubExploit		Exploit for Weak Password Recovery Mechanism for Forgotten Password in Strapi
29 Aug 202123:30
–githubexploit
githubexploit
GithubExploit		Exploit for Cross-Site Request Forgery (CSRF) in Cisco Industrial_Network_Director
12 Oct 202114:16
–githubexploit
circl
Circl		CVE-2019-18818
18 Jun 202210:22
–circl
cvelist
Cvelist		CVE-2019-18818
7 Nov 201921:02
–cvelist
exploitdb
Exploit DB		Strapi 3.0.0-beta - Set Password (Unauthenticated)
30 Aug 202100:00
–exploitdb
exploitdb
Exploit DB		Strapi CMS 3.0.0-beta.17.4 - Remote Code Execution (RCE) (Unauthenticated)
30 Aug 202100:00
–exploitdb
exploitdb
Exploit DB		Strapi CMS 3.0.0-beta.17.4 - Set Password (Unauthenticated) (Metasploit)
8 Feb 202200:00
–exploitdb
Rows per page
NVD
Node
OR
strapistrapiRange≤1.6.4
strapistrapiMatch3.0.0alpha10.1
strapistrapiMatch3.0.0alpha10.2
strapistrapiMatch3.0.0alpha10.3
strapistrapiMatch3.0.0alpha11
strapistrapiMatch3.0.0alpha11.1
strapistrapiMatch3.0.0alpha11.2
strapistrapiMatch3.0.0alpha11.3
strapistrapiMatch3.0.0alpha12
strapistrapiMatch3.0.0alpha12.1
strapistrapiMatch3.0.0alpha12.1.3
strapistrapiMatch3.0.0alpha12.2
strapistrapiMatch3.0.0alpha12.3
strapistrapiMatch3.0.0alpha12.4
strapistrapiMatch3.0.0alpha12.5
strapistrapiMatch3.0.0alpha12.6
strapistrapiMatch3.0.0alpha12.7
strapistrapiMatch3.0.0alpha12.7.1
strapistrapiMatch3.0.0alpha13
strapistrapiMatch3.0.0alpha13.0.1
strapistrapiMatch3.0.0alpha13.1
strapistrapiMatch3.0.0alpha14
strapistrapiMatch3.0.0alpha14.1
strapistrapiMatch3.0.0alpha14.1.1
strapistrapiMatch3.0.0alpha14.2
strapistrapiMatch3.0.0alpha14.3
strapistrapiMatch3.0.0alpha14.4.0
strapistrapiMatch3.0.0alpha14.5
strapistrapiMatch3.0.0alpha15
strapistrapiMatch3.0.0alpha16
strapistrapiMatch3.0.0alpha17
strapistrapiMatch3.0.0alpha18
strapistrapiMatch3.0.0alpha19
strapistrapiMatch3.0.0alpha20
strapistrapiMatch3.0.0alpha21
strapistrapiMatch3.0.0alpha22
strapistrapiMatch3.0.0alpha23
strapistrapiMatch3.0.0alpha23.1
strapistrapiMatch3.0.0alpha24
strapistrapiMatch3.0.0alpha24.1
strapistrapiMatch3.0.0alpha25
strapistrapiMatch3.0.0alpha25.1
strapistrapiMatch3.0.0alpha25.2
strapistrapiMatch3.0.0alpha26
strapistrapiMatch3.0.0alpha26.1
strapistrapiMatch3.0.0alpha26.2
strapistrapiMatch3.0.0alpha4
strapistrapiMatch3.0.0alpha4.8
strapistrapiMatch3.0.0alpha5.3
strapistrapiMatch3.0.0alpha5.5
strapistrapiMatch3.0.0alpha6.3
strapistrapiMatch3.0.0alpha6.4
strapistrapiMatch3.0.0alpha6.7
strapistrapiMatch3.0.0alpha7.2
strapistrapiMatch3.0.0alpha7.3
strapistrapiMatch3.0.0alpha8
strapistrapiMatch3.0.0alpha8.3
strapistrapiMatch3.0.0alpha9
strapistrapiMatch3.0.0alpha9.1
strapistrapiMatch3.0.0alpha9.2
strapistrapiMatch3.0.0beta0
strapistrapiMatch3.0.0beta1
strapistrapiMatch3.0.0beta10
strapistrapiMatch3.0.0beta11
strapistrapiMatch3.0.0beta12
strapistrapiMatch3.0.0beta13
strapistrapiMatch3.0.0beta14
strapistrapiMatch3.0.0beta15
strapistrapiMatch3.0.0beta16
strapistrapiMatch3.0.0beta16.1
strapistrapiMatch3.0.0beta16.2
strapistrapiMatch3.0.0beta16.3
strapistrapiMatch3.0.0beta16.4
strapistrapiMatch3.0.0beta16.5
strapistrapiMatch3.0.0beta16.6
strapistrapiMatch3.0.0beta16.7
strapistrapiMatch3.0.0beta16.8
strapistrapiMatch3.0.0beta17
strapistrapiMatch3.0.0beta17.1
strapistrapiMatch3.0.0beta17.2
strapistrapiMatch3.0.0beta17.3
strapistrapiMatch3.0.0beta17.4
strapistrapiMatch3.0.0beta2
strapistrapiMatch3.0.0beta3
strapistrapiMatch3.0.0beta4
strapistrapiMatch3.0.0beta5
strapistrapiMatch3.0.0beta6
strapistrapiMatch3.0.0beta7
strapistrapiMatch3.0.0beta8
strapistrapiMatch3.0.0beta9
ParameterPositionPathDescriptionCWE
coderequest bodyadmin/auth/reset-passwordUnauthenticated password reset vulnerability in Strapi (CVE-2019-18818).CWE-640
passwordrequest bodyadmin/auth/reset-passwordUnauthenticated password reset vulnerability in Strapi (CVE-2019-18818).CWE-640
passwordConfirmationrequest bodyadmin/auth/reset-passwordUnauthenticated password reset vulnerability in Strapi (CVE-2019-18818).CWE-640

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
17 Jun 2026 02:25Current
9.3High risk
Vulners AI Score9.3
CVSS 27.5
CVSS 3.19.8
EPSS0.97639
CWE-640In Wild
strapivulnerabilitypassword resetsecuritynvd
434