CVE-2023-36472

Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The /content-manager/relations route does not remove private fields or ensure that they can't be sele...

CVE-2020-27666

Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature.