EUVD-2024-1951

Malicious code in bioql PyPI...

EUVD-2023-2598

Malicious code in bioql PyPI...

@adishare/strapi-plugin-import-export-entries (=1.23.2), @aller/svelte-components (=1.5.17) +62 more potentially affected by CVE-2025-57350 via csvtojson (=2.0.10)

csvtojson NPM version =2.0.10 is affected by a known vulnerability. The following packages have a transitive dependency on csvtojson and may be impacted: - @adishare/strapi-plugin-import-export-entries =1.23.2 - @aller/svelte-components =1.5.17 - @arisonadim/strapi-plugin-import-export-entries...

@_sh/strapi-plugin-ckeditor (>=5.0.0 <=6.0.1), @abcxyz123321555/ckeditor5-build-test-version (>=0.7.0 <=0.10.2) +131 more potentially affected by CVE-2025-58064 via @ckeditor/ckeditor5-clipboard (>=44.2.0 <=45.2.1)

@ckeditor/ckeditor5-clipboard NPM version =44.2.0, =5.0.0, =0.7.0, =0.0.2, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.3.0-alpha.7 and more Source cves: CVE-2025-58064 Source advisory: SNYK:JS-CKEDITORCKEDITOR5CLIPBOARD-12485153...

@_sh/strapi-plugin-ckeditor (>=5.0.0 <=6.0.1), @abcxyz123321555/ckeditor5-build-test-version (>=0.7.0 <=0.10.2) +131 more potentially affected by CVE-2025-58064 via ckeditor5 (>=44.2.0 <=45.2.1)

ckeditor5 NPM version =44.2.0, =5.0.0, =0.7.0, =0.0.2, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.3.0-alpha.7 and more Source cves: CVE-2025-58064 Source advisory: OSV:GHSA-X9GP-VJH6-3WV6...

@_sh/strapi-plugin-ckeditor (>=5.0.0 <=6.0.1), @abcxyz123321555/ckeditor5-build-test-version (>=0.7.0 <=0.10.2) +131 more potentially affected by CVE-2025-58064 via @ckeditor/ckeditor5-clipboard (>=44.2.0 <=45.2.1)

@ckeditor/ckeditor5-clipboard NPM version =44.2.0, =5.0.0, =0.7.0, =0.0.2, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.3.0-alpha.7 and more Source cves: CVE-2025-58064 Source advisory: OSV:GHSA-X9GP-VJH6-3WV6...

Malicious code in d360-strapi (npm)

The package d360-strapi was found to contain malicious code...

MAL-2025-41964 Malicious code in d360-strapi (npm)

The package d360-strapi was found to contain malicious code...

MAL-2025-34011 Malicious code in strapi-upload-aws-s3 (npm)

The package strapi-upload-aws-s3 was found to contain malicious code...

Malicious code in strapi-upload-aws-s3 (npm)

The package strapi-upload-aws-s3 was found to contain malicious code...

VulnCheck KEV: CVE-2023-22893

Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that...

CVE-2024-52588

Strapi is an open-source content management system. Prior to version 4.25.2, inputting a local domain into the Webhooks URL field leads to the application fetching itself, resulting in a server side request forgery SSRF. This issue has been patched in version 4.25.2...

CVE-2024-52588

Strapi is an open-source content management system. Prior to version 4.25.2, inputting a local domain into the Webhooks URL field leads to the application fetching itself, resulting in a server side request forgery SSRF. This issue has been patched in version 4.25.2...

CVE-2024-52588 Strapi allows Server-Side Request Forgery in Webhook function

Strapi is an open-source content management system. Prior to version 4.25.2, inputting a local domain into the Webhooks URL field leads to the application fetching itself, resulting in a server side request forgery SSRF. This issue has been patched in version 4.25.2...

CVE-2024-52588 Strapi allows Server-Side Request Forgery in Webhook function

Strapi is an open-source content management system. Prior to version 4.25.2, inputting a local domain into the Webhooks URL field leads to the application fetching itself, resulting in a server side request forgery SSRF. This issue has been patched in version 4.25.2...

CVE-2024-52588

Summary (CVE-2024-52588): Strapi CMS prior to 4.25.2 is vulnerable to SSRF via the Webhooks URL field, where entering a local domain can cause the server to fetch itself. Affected component is the Webhooks URL handling; root cause is improper validation/handling of internal destinations. Impact i...

CVE-2024-52588 Strapi allows Server-Side Request Forgery in Webhook function

Strapi is an open-source content management system. Prior to version 4.25.2, inputting a local domain into the Webhooks URL field leads to the application fetching itself, resulting in a server side request forgery SSRF. This issue has been patched in version 4.25.2...

Server Side Request Forgery (SSRF)

@strapi/admin is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of webhook URLs, allowing requests to internal domains such as localhost and 127.0.0.1...

Strapi 代码问题漏洞

Strapi is an open source content management system CMS from the French strapi community. A code issue vulnerability exists in Strapi versions prior to 4.25.2, which stems from a Webhooks URL field where entering a local domain name may lead to server-side request forgery...

@beardeddudes/strapi-types (=0.1.0), @bimbeo160/admin (=4.12.2) +67 more potentially affected by CVE-2024-52588 via @strapi/admin (>=0.0.0-a230f29587d4a221c9c686ca4e467b3fb465631a <=4.25.19)

@strapi/admin NPM version =0.0.0-a230f29587d4a221c9c686ca4e467b3fb465631a, =4.12.2, =1.0.9, =1.3.2, =0.2.0, =1.0.0-alpha.0, =1.1.0, =4.12.4-lakileki.1, =4.12.4-rc4 - @musaev/strapi =4.12.4-rc2 - @musaev/strapiadmin =4.12.4 and more Source cves: CVE-2024-52588 Source advisory: OSV:GHSA-V8WJ-F5C7-P...