CVE-2019-19609

Exploit de Strapi CMS Este exploit se dirige a dos vulnerabilidades en la versión 3.0.0-beta-17.4 del framework Strapi CMS, permitiendo la ejecución remota de código RCE sin autenticación. Vulnerabilidades CVE-2019-18818 Mecanismo débil de recuperación de contraseña para contraseña olvidada CVSS ...

strapi_cms_3.0.0-beta.17.7

Strapi CMS CVE-2019-18818 y 19606 Ejecución Remota de Código a Ciegas de Strapi CMS Versión 3.0.0-beta.17.7 y anteriores para obtener una reverse shell Comenzando Ejecutando el programa Usando python3 python3 strapiexp.py -t http://strapi.hack/ -e [email protected] -p newpassword -lhost...

CVE-2019-18818_CVE-2019-19609

Exploits para CVE-2019-18818 y CVE-2019-19609 Este repositorio contiene un script en Python para explotar dos vulnerabilidades: CVE-2019-18818 y CVE-2019-19609. CVE-2019-18818 Esta vulnerabilidad permite a un atacante restablecer la contraseña de un usuario administrador en Strapi CMS. Uso 1...

Strapi-RCE

Strapi-RCE Script de explotación que muestra una combinación de CVE-2019-18818 y CVE-2019-19609 para la ejecución remota de código no autenticada en Strapi CMS. Exploit Este script explota una vulnerabilidad en Strapi CMS versiones 3.0.0-beta.17.4 y anteriores, permitiendo la ejecución remota de...

📄 Strapi CMS 5.36.1 Account Takeover

This Metasploit module exploits a critical bypass vulnerability in Strapi CMS that allows unauthenticated attackers to take over the Super Admin account. ================================================================================================================================== | Title :...

Malicious Package

Overview strapi-plugin-config is a malicious package. This package contains malicious code that conceals a command-and-control agent and credential harvester. A malicious actor published a coordinated campaign of thirty-six packages disguised as community Strapi CMS plugins. These packages aren't...

@jhoward1994/strapi-plugin-ckeditor (>=0.0.1-rc1, <=0.0.1), @privatus/strapi (>=2.0.0, <=2.0.1) +3 more potentially affected by CVE-2024-56143 via @strapi/core (>=5.0.0, <=5.5.1)

@strapi/core NPM version =5.0.0, =0.0.1-rc1, =2.0.0, =5.0.0-alpha.0, =3.0.0-beta.1, =3.0.0-beta.2 Source cves: CVE-2024-56143 Source advisory: OSV:GHSA-495J-H493-42Q2...

@avorati/strapi-plugin-preview (1.0.1), @futurebrand/helpers-strapi (>=2.0.0, <=2.5.4) +5 more potentially affected by CVE-2025-3930 via @strapi/strapi (>=5.0.0-rc.10, <=5.16.1)

@strapi/strapi NPM version =5.0.0-rc.10, =2.0.0, =2.0.0, =3.0.0-beta.1, =3.0.0-beta.2 - stronges 0.1.1 - test-lead 0.1.0 Source cves: CVE-2025-3930 Source advisory: OSV:GHSA-4R8W-3JWW-M2RP...

The vulnerability of the Strapi content management system, related to the lack of protective measures for web pages, allows a hacker to execute arbitrary JavaScript code.

The vulnerability of the CMS Strapi content management platform, related to the lack of security measures for web pages. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code by loading a specially crafted PDF file remotely...

Strapi < 4.8.0 Private Fields Sensitive Information Disclosure

Strapi is a popular open-source headless Content Management System CMS written in Node.js. Strapi versions before 4.8.0 suffer from an information disclosure vulnerability through collections private fields. By manipulating public collections query filters, a remote and unauthenticated attacker c...

CVE-2023-39345 Unauthorized Access to Private Fields in User Registration API in strapi

strapi is an open-source headless CMS. Versions prior to 4.13.1 did not properly restrict write access to fielded marked as private in the user registration endpoint. As such malicious users may be able to errantly modify their user records. This issue has been addressed in version 4.13.1. Users...

@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (0.1.0) +111 more potentially affected by CVE-2023-36472 via @strapi/utils (>=4.0.0, <=4.11.6)

@strapi/utils NPM version =4.0.0, =4.11.3, =4.11.2, =1.0.0, =1.5.1 - @codeparticle/strapi 4.9.2 - @codeparticle/strapi-admin 4.9.2 - @codeparticle/strapi-data-transfer 4.9.2 - @codeparticle/strapi-database 4.9.2 - @codeparticle/strapi-generators 4.9.2 - @codeparticle/strapi-permissions 4.9.2 -...

Design/Logic Flaw

Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the tnumber prefix. Knex query allows users to change the default prefix. For example, if someone changes the prefix to be the same as it was before or to...

Strapi 跨站脚本漏洞

Strapi is an open source content management system CMS. Strapi suffers from a cross-site scripting vulnerability that stems from insufficient filtering of user-supplied data in the file upload function, which can be exploited by remote attackers to inject and execute arbitrary HTML and script cod...

Strapi CMS Unauthenticated Password Reset

This module abuses the mishandling of a password reset request for Strapi CMS version 3.0.0-beta.17.4 to change the password of the admin user. Successfully tested against Strapi CMS version 3.0.0-beta.17.4. Module Options msf use auxiliary/scanner/http/strapi/3passwordreset msf...

Strapi CMS 3.0.0-beta.17.4 Privilege Escalation

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule "Strapi CMS 3.0.0-beta.17.4 - Set Password Unauthenticated Metasploit", 'Description' = %q This exploit module abuses the...

Strapi CMS 3.0.0-beta.17.4 - Set Password (Unauthenticated) (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule "Strapi CMS 3.0.0-beta.17.4 - Set Password Unauthenticated Metasploit", 'Description' = %q This exploit module abuses the...

Strapi CMS 3.0.0-beta.17.4 - Set Password (Unauthenticated) Exploit

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule "Strapi CMS 3.0.0-beta.17.4 - Set Password Unauthenticated Metasploit", 'Description' = %q This exploit module abuses the...

Strapi CMS 3.0.0-beta.17.4 Remote Code Execution

Exploit Title: Strapi CMS 3.0.0-beta.17.4 - Remote Code Execution RCE Unauthenticated Date: 2021-08-30 Exploit Author: Musyoka Ian Vendor Homepage: https://strapi.io/ Software Link: https://strapi.io/ Version: Strapi CMS version 3.0.0-beta.17.4 or lower Tested on: Ubuntu 20.04 CVE : CVE-2019-1881...

Strapi CMS 3.0.0-beta.17.4 - Remote Code Execution (Unauthenticated) Exploit

Exploit Title: Strapi CMS 3.0.0-beta.17.4 - Remote Code Execution RCE Unauthenticated Exploit Author: Musyoka Ian Vendor Homepage: https://strapi.io/ Software Link: https://strapi.io/ Version: Strapi CMS version 3.0.0-beta.17.4 or lower Tested on: Ubuntu 20.04 CVE : CVE-2019-18818, CVE-2019-19609...