@piksail/strapi-plugin-publish-coolify (0.0.1), cypherscan-strapi (0.1.1) +4 more potentially affected by CVE-2025-64526 via @strapi/plugin-users-permissions (>=5.11.0, <=5.42.1)

@strapi/plugin-users-permissions NPM version =5.11.0, =0.1.0, =0.1.4 - stronges 0.1.1 - test-lead 0.1.0 Source cves: CVE-2025-64526 Source advisory: SNYK:JS-STRAPIPLUGINUSERSPERMISSIONS-16683088...

@piksail/strapi-plugin-publish-coolify (0.0.1), cypherscan-strapi (0.1.1) +4 more potentially affected by CVE-2025-64526 via @strapi/plugin-users-permissions (>=5.11.0, <=5.42.1)

@strapi/plugin-users-permissions NPM version =5.11.0, =0.1.0, =0.1.4 - stronges 0.1.1 - test-lead 0.1.0 Source cves: CVE-2025-64526 Source advisory: OSV:GHSA-7MQX-WWH4-F9FW...

@chargeover/strapi (0.0.1-rc1.1), @code-mancers/strapi-plugin-stellate (>=1.0.0, <=1.4.3) +18 more potentially affected by CVE-2024-34065 via @strapi/plugin-users-permissions (>=4.0.0-beta.0, <=4.19.0)

@strapi/plugin-users-permissions NPM version =4.0.0-beta.0, =1.0.0, =1.0.0-alpha.0, =2.1.0, =1.0.0, =0.0.1, =0.0.4 - devlaunchers-strapiv4 0.1.0 - easylaser-vn-cms 0.1.0 - sneakmax 0.1.0 - sneakmaxtesttemplate 0.1.0 - sneakmaxtesttemplatev2 0.1.0 - strapi-ent-a 0.1.0 - strapi-fcm 0.1.0 -...

CVE-2024-34065: Authentication Bypass by Capture-replay

Strapi is an open-source content management system. By combining two vulnerabilities an Open Redirect and session token sent as URL query parameter in @strapi/plugin-users-permissions before version 4.24.2, is its possible of an unauthenticated attacker to bypass authentication mechanisms and...

@chargeover/strapi (0.0.1-rc1.1), @mattie-bundle/mattie-strapi-bundle-example (>=1.0.0-alpha.0, <=1.0.0-alpha.3) +7 more potentially affected by CVE-2023-22621 via @strapi/plugin-users-permissions (>=4.0.0-beta.0, <=4.5.1)

@strapi/plugin-users-permissions NPM version =4.0.0-beta.0, =1.0.0-alpha.0, =2.1.0, =1.0.0, =1.0.2 - easylaser-vn-cms 0.1.0 - strapi-ent-a 0.1.0 - strapi-fcm 0.1.0 - strapi-voting 0.2.1 - sveltekit-strapi 0.1.0 Source cves: CVE-2023-22621 Source advisory: OSV:GHSA-2H87-4Q2W-V4HF...

CVE-2019-18818: Weak Password Recovery Mechanism for Forgotten Password

strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js...

PT-2019-15677

Name of the Vulnerable Software and Affected Versions strapi versions prior to 3.0.0-beta.17.5 Description The issue is related to the mishandling of password resets within the strapi-admin and strapi-plugin-users-permissions packages. Specifically, the password reset routes allow an...