CVE-2019-18818

strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js...

EUVD-2022-6092

Malicious code in bioql PyPI...

Strapi 注入漏洞

Strapi is an open source content management system CMS. A security vulnerability exists in Strapi versions prior to 4.5.5, which can be exploited by an attacker to inject a crafted payload that executes code on the server into an email template, thereby bypassing validation checks that are suppos...

PT-2023-18592

Name of the Vulnerable Software and Affected Versions Strapi versions 4.5.5 and earlier Description Strapi allows authenticated Server-Side Template Injection SSTI that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a...

PT-2023-33074 · Amazon · Aws Cognito

Name of the Vulnerable Software and Affected Versions: Strapi versions 4.5.6 and earlier Description: The issue concerns the verification of access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token...

PT-2023-18758 · Strapi · Strapi

Name of the Vulnerable Software and Affected Versions: Strapi versions 4.5.5 and earlier Strapi versions 4.7.1 and earlier Description: The issue allows attackers with access to the admin panel to discover sensitive user details by exploiting the query filter. An attacker can filter users by...