Exploit for OS Command Injection in Strapi

CVE-2019-19609 Strapi Remote Code...

Strapi 3.0.0-beta Authentication Bypass

Exploit Title: Strapi 3.0.0-beta - Set Password Unauthenticated Date: 2021-08-29 Exploit Author: David Anglada CodiObert Vendor Homepage: https://strapi.io/ Version: 3.0.0-beta Tested on: Linux CVE: CVE-2019-18818 !/usr/bin/python import requests import sys import json userEmail = "[email protected]...

Exploit for OS Command Injection in Strapi

CVE-2019-19609 Strap...

Strapi 3.0.0-beta.17.7 Remote Code Execution

Exploit Title: Strapi 3.0.0-beta.17.7 - Remote Code Execution RCE Authenticated Date: 29/08/2021 Exploit Author: David Utón M3n0sD0n4ld Vendor Homepage: https://strapi.io/ Affected Version: strapi-3.0.0-beta.17.7 and earlier Tested on: Linux Ubuntu 18.04.5 LTS CVE : CVE-2019-19609 !/usr/bin/pytho...

Strapi CMS 3.0.0-beta.17.4 Remote Code Execution

Exploit Title: Strapi CMS 3.0.0-beta.17.4 - Remote Code Execution RCE Unauthenticated Date: 2021-08-30 Exploit Author: Musyoka Ian Vendor Homepage: https://strapi.io/ Software Link: https://strapi.io/ Version: Strapi CMS version 3.0.0-beta.17.4 or lower Tested on: Ubuntu 20.04 CVE : CVE-2019-1881...

Strapi 3.0.0-beta.17.7 - Remote Code Execution (RCE) (Authenticated)

Exploit Title: Strapi 3.0.0-beta.17.7 - Remote Code Execution RCE Authenticated Date: 29/08/2021 Exploit Author: David Utón M3n0sD0n4ld Vendor Homepage: https://strapi.io/ Affected Version: strapi-3.0.0-beta.17.7 and earlier Tested on: Linux Ubuntu 18.04.5 LTS CVE : CVE-2019-19609 !/usr/bin/pytho...

Strapi 3.0.0-beta - Set Password (Unauthenticated)

Exploit Title: Strapi 3.0.0-beta - Set Password Unauthenticated Date: 2021-08-29 Exploit Author: David Anglada CodiObert Vendor Homepage: https://strapi.io/ Version: 3.0.0-beta Tested on: Linux CVE: CVE-2019-18818 !/usr/bin/python import requests import sys import json userEmail = "[email protected]...

Strapi 3.0.0-beta - Set Password (Unauthenticated) Exploit

Exploit Title: Strapi 3.0.0-beta - Set Password Unauthenticated Date: 2021-08-29 Exploit Author: David Anglada CodiObert Vendor Homepage: https://strapi.io/ Version: 3.0.0-beta Tested on: Linux CVE: CVE-2019-18818 !/usr/bin/python import requests import sys import json userEmail = "email protecte...

Strapi 3.0.0-beta.17.7 - Remote Code Execution (Authenticated) Exploit

Exploit Title: Strapi 3.0.0-beta.17.7 - Remote Code Execution RCE Authenticated Date: 29/08/2021 Exploit Author: David Utón M3n0sD0n4ld Vendor Homepage: https://strapi.io/ Affected Version: strapi-3.0.0-beta.17.7 and earlier Tested on: Linux Ubuntu 18.04.5 LTS CVE : CVE-2019-19609 !/usr/bin/pytho...

Strapi CMS 3.0.0-beta.17.4 - Remote Code Execution (Unauthenticated) Exploit

Exploit Title: Strapi CMS 3.0.0-beta.17.4 - Remote Code Execution RCE Unauthenticated Exploit Author: Musyoka Ian Vendor Homepage: https://strapi.io/ Software Link: https://strapi.io/ Version: Strapi CMS version 3.0.0-beta.17.4 or lower Tested on: Ubuntu 20.04 CVE : CVE-2019-18818, CVE-2019-19609...

Strapi CMS 3.0.0-beta.17.4 - Remote Code Execution (RCE) (Unauthenticated)

Exploit Title: Strapi CMS 3.0.0-beta.17.4 - Remote Code Execution RCE Unauthenticated Date: 2021-08-30 Exploit Author: Musyoka Ian Vendor Homepage: https://strapi.io/ Software Link: https://strapi.io/ Version: Strapi CMS version 3.0.0-beta.17.4 or lower Tested on: Ubuntu 20.04 CVE : CVE-2019-1881...

Exploit for Weak Password Recovery Mechanism for Forgotten Password in Strapi

CVE-2019...

Exploit for OS Command Injection in Strapi

CVE-2019-19609-EXPLOIT Exploit for CVE-2019-19609 in Strapi R...

Exploit for OS Command Injection in Strapi

CVE-2019-19609 Strapi Framework Vulnerable to Remote Code Exec...

Authorization Bypass

Overview admin/src/containers/InputModalStepperProvider/index.js in strapi before 3.2.5 has unwanted /proxy?url= functionality. Recommendation Upgrade to version 3.2.5 or later References - CVE - GitHub Advisory...

GHSA-7FRV-9PHW-VRVR Authorization bypass in Strapi

admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality...

@koj/strapi (>=0.0.0, <=1.4.0), @symbol-it/strapi-plugin-mailjet (>=0.0.1, <=0.0.2) +5 more potentially affected by CVE-2020-27664 via strapi (>=3.0.0, <=3.1.6)

strapi NPM version =3.0.0, =0.0.0, =0.0.1, =0.0.34, =0.0.1-alpha.1, =0.0.1-alpha.2 - strapi-plugin-mailjet 0.0.2 Source cves: CVE-2020-27664 Source advisory: OSV:GHSA-7FRV-9PHW-VRVR...

Authorization bypass in Strapi

admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality...

@codious/core (>=1.0.6, <=1.2.6), @koj/strapi (>=1.4.1, <=1.4.3) +6 more potentially affected by CVE-2021-26540 via sanitize-html (>=2.1.0, <=2.3.1)

sanitize-html NPM version =2.1.0, =1.0.6, =1.4.1, =3.37.0, =2.1.56, =2.0.58, =0.12.0, =3.2.5, =3.5.2 Source cves: CVE-2021-26540 Source advisory: OSV:GHSA-MJXR-4V3X-Q3M4...

@codious/core (>=1.0.6, <=1.2.4), @koj/strapi (>=1.4.1, <=1.4.3) +6 more potentially affected by CVE-2021-26539 via sanitize-html (>=2.1.0, <=2.3.0)

sanitize-html NPM version =2.1.0, =1.0.6, =1.4.1, =3.37.0, =2.1.56, =2.0.58, =0.12.0, =3.2.5, =3.5.2 Source cves: CVE-2021-26539 Source advisory: OSV:GHSA-RJQQ-98F6-6J3R...