947 matches found
CVE-2025-3930
Strapi is affected by CVE-2025-3930 due to improper JWT handling: after logout or account deactivation, tokens are not invalidated, enabling an attacker to reuse stolen or intercepted tokens until their expiry. The presence of the publicly accessible /admin/renew-token endpoint further enables ne...
CVE-2025-3930 Lack of JWT Expiration after Log Out in Strapi
Strapi uses JSON Web Tokens JWT for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date which is set to 30 days by default, but can be changed. The existence...
CVE-2025-25298: Weak Encoding for Password
Strapi is an open source headless CMS. The @strapi/core package before version 5.10.3 does not enforce a maximum password length when using bcryptjs for password hashing. Bcryptjs ignores any bytes beyond 72, so passwords longer than 72 bytes are silently truncated. A user can create an account...
CVE-2025-3930: Insufficient Session Expiration
Strapi uses JSON Web Tokens JWT for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date which is set to 30 days by default, but can be changed. The existence...
Strapi 安全漏洞
Strapi is an open source content management system CMS from the French strapi community. A security vulnerability exists in Strapi versions prior to 5.10.3 that stems from not enforcing the maximum password length for bcryptjs password hashes, which could result in passwords being silently...
Strapi 代码问题漏洞
Strapi is an open source content management system CMS from the French strapi community. A code issue vulnerability exists in Strapi versions prior to 5.24.1, which stems from the failure to invalidate the JWT after logging out or deactivating an account and the presence of the /admin/renew-token...
PT-2025-42494
Name of the Vulnerable Software and Affected Versions Strapi versions prior to 5.20.0 Description Strapi, an open source headless content management system, has a Cross-Origin Resource Sharing CORS misconfiguration in default installations. The system reflects the value of the Origin header in th...
PT-2025-42486
Name of the Vulnerable Software and Affected Versions Strapi versions prior to 5.10.3 Description Strapi, an open source headless CMS, has an issue where the @strapi/core package does not enforce a maximum password length when using bcryptjs for password hashing. Bcryptjs truncates passwords...
PT-2025-42459
Name of the Vulnerable Software and Affected Versions Strapi versions prior to 5.24.1 Description Strapi utilizes JSON Web Tokens JWT for authentication. Following logout or account deactivation, JWTs are not invalidated, enabling an attacker with a stolen or intercepted token to reuse it until i...
PT-2025-42484
Name of the Vulnerable Software and Affected Versions Strapi versions 5.0.0 through 5.5.1 Description Strapi is an open-source headless content management system. A flaw in the document service lookup does not properly sanitize query parameters for private fields. This allows an attacker to acces...
CVE-2024-56143: Authorization Bypass Through User-Controlled Key
Strapi is an open-source headless content management system. In versions from 5.0.0 to before 5.5.2, the lookup operator provided by the document service does not properly sanitize query parameters for private fields. An attacker can access private fields, including admin passwords and reset...
CVE-2025-53092: Exposure of Sensitive Information to an Unauthorized Actor
Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability in default installations. By default, Strapi reflects the value of the Origin header back in the Access-Control-Allow-Origin response header without proper...
Strapi 安全漏洞
Strapi is an open source content management system CMS from the French strapi community. A security vulnerability exists in Strapi versions prior to 5.20.0, which stems from a CORS misconfiguration in the default installation that could lead to a cross-resource sharing attack...
Strapi 安全漏洞
Strapi is an open source content management system CMS from the French strapi community. A security vulnerability exists in Strapi versions 5.0.0 through prior to 5.5.2, which stems from a lookup operation in the document service that does not properly clean up the query parameters for private...
EUVD-2020-1407
Malware in sbrugna...
EUVD-2021-2146
Malware in sbrugna...
EUVD-2021-0997
Malware in sbrugna...
EUVD-2020-1436
Malware in sbrugna...