Priority CRITICAL 91KEV
Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.04114 · Published 2023-04-19 · Fixed in 4.8.0 CWE-312
Priority CRITICAL 87
strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.97639 · Published 2019-11-07 · Fixed in 3.0.0-beta.17.5 CWE-640
Priority HIGH 81
Strapi is the an open-source headless content management system.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00963 · Published 2023-09-15 · Fixed in 4.12.1 CWE-770
Priority HIGH 80
Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server.
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.706 · Published 2023-04-19 · Fixed in 4.5.6 CWE-74
Priority HIGH 76
Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.00556 · Published 2024-06-20 · No fix listed CWE-918
Priority HIGH 76
Strapi is an open-source headless content management system.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.01095 · Published 2023-07-25 · Fixed in 4.10.8 CWE-200
Priority HIGH 75
Strapi is an open-source headless content management system.
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.00418 · Published 2025-10-16 · Fixed in 5.5.2 CWE-639
Priority HIGH 66
Strapi is an open-source content management system.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00586 · Published 2025-05-29 · Fixed in 4.25.2 CWE-918
Priority HIGH 66
strapi is an open-source headless CMS.
CVSS 3.1HIGH 7.6· Adjacent network · No auth · No interaction · EPSS 0.00593 · Published 2023-11-06 · Fixed in 4.13.1 CWE-287
Priority MEDIUM 64
Strapi is an open-source headless content management system.
CVSS 3.1HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00715 · Published 2023-07-25 · Fixed in 4.10.8 CWE-200
Priority MEDIUM 64
The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject…
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.54081 · Published 2019-12-05 · Fixed in 3.0.0-beta.17.8 CWE-78
Priority MEDIUM 63
Strapi is the an open-source headless content management system.
CVSS 3.1MEDIUM 6.8· Network · Low privileges · User interaction · EPSS 0.00635 · Published 2023-09-15 · Fixed in 4.12.1 CWE-200
Priority MEDIUM 62
Strapi is an open-source content management system.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00736 · Published 2024-06-12 · Fixed in 4.22.0 CWE-248
Priority MEDIUM 61
Strapi is an open source headless CMS.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.004 · Published 2025-10-16 · Fixed in 5.10.3 CWE-261
Priority MEDIUM 59
Strapi is an open-source headless content management system.
CVSS 3.1MEDIUM 5.8· Network · Low privileges · User interaction · EPSS 0.00672 · Published 2023-09-15 · Fixed in 4.11.7 CWE-200
Priority MEDIUM 57
Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00199 · Published 2026-10-10 · No fix listed CWE-863
Priority MEDIUM 50
Strapi is an open-source content management system.
CVSS 3.1LOW 3.5· Network · Low privileges · User interaction · EPSS 0.00385 · Published 2024-06-12 · Fixed in 4.19.1 CWE-639
Priority MEDIUM 49
Strapi is an open source headless content management system.
CVSS 4.0CRITICAL 9.2· Network · No auth · No interaction · EPSS 0.01916 · Published 2026-05-14 · Fixed in 5.37.0 CWE-200
Priority MEDIUM 49
Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication.
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.04124 · Published 2023-04-19 · Fixed in 4.6.0 CWE-287
Priority MEDIUM 48
An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03221 · Published 2022-04-12 · No fix listed CWE-434
Priority MEDIUM 47
The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights for the underlying document.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00287 · Published 2026-10-27 · No fix listed CWE-862
Priority MEDIUM 46
admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02292 · Published 2020-10-22 · Fixed in 3.2.5 CWE-862
Priority MEDIUM 44
Strapi is an open source headless content management system.
CVSS 4.0CRITICAL 9.3· Network · High privileges · No interaction · EPSS 0.01178 · Published 2026-05-14 · Fixed in 5.33.2, 4.26.1 CWE-89
Priority MEDIUM 43
Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0172 · Published 2022-09-27 · Fixed in 3.6.10, 4.1.10 CWE-89
Priority MEDIUM 42
Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text.
CVSS 4.0CRITICAL 9.3· Network · Low privileges · User interaction · EPSS 0.0043 · Published 2026-09-13 · Fixed in 5.48.1 CWE-79
Load more
THREATIST.IORead the docs