726 matches found
CVE-2024-56143 Strapi Allows Unauthorized Access to Private Fields via parms.lookup
Strapi is an open-source headless content management system. In versions from 5.0.0 to before 5.5.2, the lookup operator provided by the document service does not properly sanitize query parameters for private fields. An attacker can access private fields, including admin passwords and reset...
@avorati/strapi-plugin-preview (1.0.1), @futurebrand/helpers-strapi (>=2.0.0, <=2.5.4) +5 more potentially affected by CVE-2025-3930 via @strapi/strapi (>=5.0.0-rc.10, <=5.16.1)
@strapi/strapi NPM version =5.0.0-rc.10, =2.0.0, =2.0.0, =3.0.0-beta.1, =3.0.0-beta.2 - stronges 0.1.1 - test-lead 0.1.0 Source cves: CVE-2025-3930 Source advisory: OSV:GHSA-4R8W-3JWW-M2RP...
@avorati/strapi-plugin-preview (1.0.1), @futurebrand/helpers-strapi (>=2.0.0, <=2.5.4) +10 more potentially affected by CVE-2025-3930 via @strapi/admin (>=5.0.0, <=5.23.6)
@strapi/admin NPM version =5.0.0, =2.0.0, =0.0.1-rc1, =2.0.0, =5.0.0-alpha.0, =5.0.0-alpha.7, =5.0.0-alpha.0, =3.0.0-beta.1, =3.0.4 - stronges 0.1.1 - test-lead 0.1.0 Source cves: CVE-2025-3930 Source advisory: SNYK:JS-STRAPIADMIN-13601310...
EUVD-2025-34751
Strapi is vulnerable to Insufficient Session Expiration...
Strapi is vulnerable to Insufficient Session Expiration
Strapi uses JSON Web Tokens JWT for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date which is set to 30 days by default, but can be changed. The existence...
Insufficient Session Expiration
Overview @strapi/admin is a Strapi Admin Affected versions of this package are vulnerable to Insufficient Session Expiration due to the failure to invalidate JWT after logout or account deactivation. An attacker can maintain unauthorized access by reusing a stolen or intercepted token until it...
CVE-2025-3930
Strapi uses JSON Web Tokens JWT for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date which is set to 30 days by default, but can be changed. The existence...
CVE-2025-3930 Lack of JWT Expiration after Log Out in Strapi
Strapi uses JSON Web Tokens JWT for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date which is set to 30 days by default, but can be changed. The existence...
CVE-2025-3930
Strapi is affected by CVE-2025-3930 due to improper JWT handling: after logout or account deactivation, tokens are not invalidated, enabling an attacker to reuse stolen or intercepted tokens until their expiry. The presence of the publicly accessible /admin/renew-token endpoint further enables ne...
CVE-2025-3930 Lack of JWT Expiration after Log Out in Strapi
Strapi uses JSON Web Tokens JWT for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date which is set to 30 days by default, but can be changed. The existence...
CVE-2025-3930 Lack of JWT Expiration after Log Out in Strapi
Strapi uses JSON Web Tokens JWT for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date which is set to 30 days by default, but can be changed. The existence...
Strapi 安全漏洞
Strapi is an open source content management system CMS from the French strapi community. A security vulnerability exists in Strapi versions prior to 5.20.0, which stems from a CORS misconfiguration in the default installation that could lead to a cross-resource sharing attack...
Strapi 安全漏洞
Strapi is an open source content management system CMS from the French strapi community. A security vulnerability exists in Strapi versions prior to 5.10.3 that stems from not enforcing the maximum password length for bcryptjs password hashes, which could result in passwords being silently...
Strapi 代码问题漏洞
Strapi is an open source content management system CMS from the French strapi community. A code issue vulnerability exists in Strapi versions prior to 5.24.1, which stems from the failure to invalidate the JWT after logging out or deactivating an account and the presence of the /admin/renew-token...
Strapi 安全漏洞
Strapi is an open source content management system CMS from the French strapi community. A security vulnerability exists in Strapi versions 5.0.0 through prior to 5.5.2, which stems from a lookup operation in the document service that does not properly clean up the query parameters for private...
EUVD-2021-2416
Malware in sbrugna...
EUVD-2021-0997
Malware in sbrugna...
EUVD-2020-1407
Malware in sbrugna...