Strapi Admin - Installer Detection

Strapi Admin Registration enabled was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Strapi Admin Registration enabled was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Strapi Admin - Installer...

@antgineering-studio/strapi (4.5.5), @avorati/strapi-plugin-preview (1.0.1) +149 more potentially affected by CVE-2026-22706 via @strapi/admin (>=0.0.0-0aec9b313e84cebcbd4d2cae07cdd3837003f20b, <=5.33.2)

@strapi/admin NPM version =0.0.0-0aec9b313e84cebcbd4d2cae07cdd3837003f20b, =0.1.0, =1.0.1, =4.12.2, =1.0.0, =5.30.1, =1.0.0, =1.3.0, =1.3.4, =1.4.3 and more Source cves: CVE-2026-22706 Source advisory: MEND:CVE-2026-22706...

@avorati/strapi-plugin-preview (1.0.1), @catchmexz/fedin-cms (>=5.30.1, <=5.30.2) +12 more potentially affected by CVE-2026-22706 via @strapi/admin (>=5.0.0-alpha.0, <=5.33.2)

@strapi/admin NPM version =5.0.0-alpha.0, =5.30.1, =2.0.0, =0.0.1-rc1, =2.0.0, =5.0.0-alpha.0, =5.0.0-alpha.7, =5.0.0-alpha.0, =3.0.0-beta.1, =3.0.4 - stronges 0.1.1 - test-lead 0.1.0 Source cves: CVE-2026-22706 Source advisory: SNYK:JS-STRAPIADMIN-16682288...

@avorati/strapi-plugin-preview (1.0.1), @catchmexz/fedin-cms (>=5.30.1, <=5.30.2) +12 more potentially affected by CVE-2026-22706 via @strapi/admin (>=5.0.0-alpha.0, <=5.33.2)

@strapi/admin NPM version =5.0.0-alpha.0, =5.30.1, =2.0.0, =0.0.1-rc1, =2.0.0, =5.0.0-alpha.0, =5.0.0-alpha.7, =5.0.0-alpha.0, =3.0.0-beta.1, =3.0.4 - stronges 0.1.1 - test-lead 0.1.0 Source cves: CVE-2026-22706 Source advisory: OSV:GHSA-HVP3-26WX-G2W4...

Insufficient Session Expiration

Overview @strapi/admin is a Strapi Admin Affected versions of this package are vulnerable to Insufficient Session Expiration in the password reset or change operation. An attacker can maintain unauthorized access by continuing to use a previously obtained refresh token to generate new access...

@avorati/strapi-plugin-preview (1.0.1), @catchmexz/fedin-cms (>=5.30.1, <=5.30.2) +12 more potentially affected by CVE-2026-22706 via @strapi/admin (>=5.0.0-alpha.0, <=5.33.2)

@strapi/admin NPM version =5.0.0-alpha.0, =5.30.1, =2.0.0, =0.0.1-rc1, =2.0.0, =5.0.0-alpha.0, =5.0.0-alpha.7, =5.0.0-alpha.0, =3.0.0-beta.1, =3.0.4 - stronges 0.1.1 - test-lead 0.1.0 Source cves: CVE-2026-22706 Source advisory: GHSA-HVP3-26WX-G2W4...

@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (0.1.0) +90 more potentially affected by CVE-2025-25298 via @strapi/admin (>=4.0.0-beta.0, <=4.25.21)

@strapi/admin NPM version =4.0.0-beta.0, =4.12.2, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.2, =4.2.3 and more Source cves: CVE-2025-25298 Source advisory: SNYK:JS-STRAPIADMIN-13601311...

Weak Encoding for Password

Overview @strapi/admin is a Strapi Admin Affected versions of this package are vulnerable to Weak Encoding for Password in to the implementation of password hashing. An attacker can reduce the effective entropy of user passwords and potentially mislead users about the required password length by...

@avorati/strapi-plugin-preview (1.0.1), @futurebrand/helpers-strapi (>=2.0.0, <=2.5.4) +10 more potentially affected by CVE-2025-3930 via @strapi/admin (>=5.0.0-alpha.0, <=5.23.6)

@strapi/admin NPM version =5.0.0-alpha.0, =2.0.0, =0.0.1-rc1, =2.0.0, =5.0.0-alpha.0, =5.0.0-alpha.7, =5.0.0-alpha.0, =3.0.0-beta.1, =3.0.4 - stronges 0.1.1 - test-lead 0.1.0 Source cves: CVE-2025-3930 Source advisory: SNYK:JS-STRAPIADMIN-13601310...

Insufficient Session Expiration

Overview @strapi/admin is a Strapi Admin Affected versions of this package are vulnerable to Insufficient Session Expiration due to the failure to invalidate JWT after logout or account deactivation. An attacker can maintain unauthorized access by reusing a stolen or intercepted token until it...

EUVD-2022-3703

Malicious code in bioql PyPI...

@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (0.1.0) +83 more potentially affected by CVE-2024-52588 via @strapi/admin (>=0.0.0-a3d182e0454ccff2702450b31621cd5026b389ca, <=4.25.1)

@strapi/admin NPM version =0.0.0-a3d182e0454ccff2702450b31621cd5026b389ca, =4.12.2, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.2, =4.2.3 and more Source cves: CVE-2024-52588 Source advisory: MEND:CVE-2024-52588...

Server Side Request Forgery (SSRF)

@strapi/admin is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of webhook URLs, allowing requests to internal domains such as localhost and 127.0.0.1...

@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (0.1.0) +82 more potentially affected by CVE-2024-52588 via @strapi/admin (>=4.0.0-beta.0, <=4.25.1)

@strapi/admin NPM version =4.0.0-beta.0, =4.12.2, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.2, =4.2.3 and more Source cves: CVE-2024-52588 Source advisory: OSV:GHSA-V8WJ-F5C7-PVXF...

@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (0.1.0) +82 more potentially affected by CVE-2024-52588 via @strapi/admin (>=4.0.0-beta.0, <=4.25.1)

@strapi/admin NPM version =4.0.0-beta.0, =4.12.2, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.2, =4.2.3 and more Source cves: CVE-2024-52588 Source advisory: GHSA-V8WJ-F5C7-PVXF...

CVE-2022-30617

An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel users that have a relationship e.g., created by, updated by with content accessible to the authenticated user. For example, a...

CVE-2022-30618

An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if content types accessible to the authenticated user contain relationships to API users from:users-permissions. There are many scenarios in whic...

@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (0.1.0) +50 more potentially affected by CVE-2023-38507 via @strapi/admin (>=0.0.0-a3d182e0454ccff2702450b31621cd5026b389ca, <=4.12.0)

@strapi/admin NPM version =0.0.0-a3d182e0454ccff2702450b31621cd5026b389ca, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.2, =4.9.2, =4.9.2, =1.0.5, =2.0.13 and more Source cves: CVE-2023-38507 Source advisory: MEND:CVE-2023-38507...

@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (0.1.0) +47 more potentially affected by CVE-2023-36472 via @strapi/admin (>=0.0.0-a3d182e0454ccff2702450b31621cd5026b389ca, <=4.11.6)

@strapi/admin NPM version =0.0.0-a3d182e0454ccff2702450b31621cd5026b389ca, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.2, =4.9.2, =4.9.2, =1.0.5, =2.0.13 and more Source cves: CVE-2023-36472 Source advisory: MEND:CVE-2023-36472...

@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (0.1.0) +48 more potentially affected by CVE-2023-38507 via @strapi/admin (>=4.0.0-beta.0, <=4.12.0)

@strapi/admin NPM version =4.0.0-beta.0, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.2, =4.9.2, =4.9.2, =1.0.5, =2.0.13 and more Source cves: CVE-2023-38507 Source advisory: GHSA-24Q2-59HM-RH9R...