Priority CRITICAL 91KEV
Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.04114 · Published 2023-04-19 · Fixed in 4.8.0 CWE-312
Priority CRITICAL 87
strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.97639 · Published 2019-11-07 · Fixed in 3.0.0-beta.17.5 CWE-640
Priority HIGH 81
Strapi is the an open-source headless content management system.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00963 · Published 2023-09-15 · Fixed in 4.12.1 CWE-770
Priority HIGH 80
Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server.
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.706 · Published 2023-04-19 · Fixed in 4.5.6 CWE-74
Priority HIGH 76
Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.00556 · Published 2024-06-20 · No fix listed CWE-918
Priority HIGH 76
Strapi is an open-source headless content management system.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.01095 · Published 2023-07-25 · Fixed in 4.10.8 CWE-200
Priority HIGH 75
Strapi is an open-source headless content management system.
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.00418 · Published 2025-10-16 · Fixed in 5.5.2 CWE-639
Priority HIGH 66
Strapi is an open-source content management system.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00586 · Published 2025-05-29 · Fixed in 4.25.2 CWE-918
Priority HIGH 66
strapi is an open-source headless CMS.
CVSS 3.1HIGH 7.6· Adjacent network · No auth · No interaction · EPSS 0.00593 · Published 2023-11-06 · Fixed in 4.13.1 CWE-287
Priority MEDIUM 64
Strapi is an open-source headless content management system.
CVSS 3.1HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00715 · Published 2023-07-25 · Fixed in 4.10.8 CWE-200
Priority MEDIUM 64
The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject…
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.54081 · Published 2019-12-05 · Fixed in 3.0.0-beta.17.8 CWE-78
Priority MEDIUM 63
Strapi is the an open-source headless content management system.
CVSS 3.1MEDIUM 6.8· Network · Low privileges · User interaction · EPSS 0.00635 · Published 2023-09-15 · Fixed in 4.12.1 CWE-200
Priority MEDIUM 62
Strapi is an open-source content management system.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00736 · Published 2024-06-12 · Fixed in 4.22.0 CWE-248
Priority MEDIUM 61
Strapi is an open source headless CMS.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.004 · Published 2025-10-16 · Fixed in 5.10.3 CWE-261
Priority MEDIUM 59
Strapi is an open-source headless content management system.
CVSS 3.1MEDIUM 5.8· Network · Low privileges · User interaction · EPSS 0.00672 · Published 2023-09-15 · Fixed in 4.11.7 CWE-200
Priority MEDIUM 50
Strapi is an open-source content management system.
CVSS 3.1LOW 3.5· Network · Low privileges · User interaction · EPSS 0.00385 · Published 2024-06-12 · Fixed in 4.19.1 CWE-639
Priority MEDIUM 49
Strapi is an open source headless content management system.
CVSS 4.0CRITICAL 9.2· Network · No auth · No interaction · EPSS 0.01916 · Published 2026-05-14 · Fixed in 5.37.0 CWE-200
Priority MEDIUM 49
Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication.
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.04124 · Published 2023-04-19 · Fixed in 4.6.0 CWE-287
Priority MEDIUM 48
An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03221 · Published 2022-04-12 · No fix listed CWE-434
Priority MEDIUM 46
admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02292 · Published 2020-10-22 · Fixed in 3.2.5 CWE-862
Priority MEDIUM 44
Strapi is an open source headless content management system.
CVSS 4.0CRITICAL 9.3· Network · High privileges · No interaction · EPSS 0.01178 · Published 2026-05-14 · Fixed in 5.33.2, 4.26.1 CWE-89
Priority MEDIUM 43
Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0172 · Published 2022-09-27 · Fixed in 3.6.10, 4.1.10 CWE-89
Priority MEDIUM 42
An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01974 · Published 2022-07-13 · No fix listed CWE-434
Priority MEDIUM 41
An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel users that have a relationship (e.g., created by, updated by…
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01473 · Published 2022-05-19 · Fixed in 3.6.9, 4.0.0-beta.16 +1 CWE-212
Priority LOW 39
Strapi is an open source headless content management system.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00492 · Published 2026-05-14 · Fixed in 5.45.0 CWE-307
Load more
THREATIST.IORead the docs