ST
Product
strapi
On CISA KEVExploited in the wild
41
CVEs
1
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 4High 20Medium 15Low 2
Watch
Add strapi to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-31367 | 8.8 | Sep 27 | Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses Affected: before 3.6.10; 4.0.0 before 4.1.10 |
| CVE-2022-32114 | 8.8 | Jul 13 | An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file Affected: 4.1.12 |
| CVE-2022-30617 | 8.8 | May 19 | An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel users that have a… Affected: 3.0.0 before 3.6.10; 4.0.0; 4.0.0; 4.0.0; 4.0.0; 4.0.0; +9 more |
| CVE-2026-90561 | 8.7 | Sep 13 | Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG Affected: 4.0.0 through 4.26.2; 5.0.0 before 5.48.1 |
| CVE-2024-37818 | 8.6 | Jun 20 | Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image Affected: 4.24.4 |
| CVE-2024-56143 | 8.2 | Oct 16 | Strapi is an open-source headless content management system Affected: 5.0.0 before 5.5.2 |
| CVE-2024-34065 | 8.1 | Jun 12 | Strapi is an open-source content management system Affected: before 4.24.2 |
| CVE-2021-28128 | 8.1 | May 6 | In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password Affected: through 3.6.0 |
| CVE-2026-27886 | 7.5 | May 14 | Strapi may leak sensitive data via relational filtering due to lack of query sanitization Affected: >= 4.0.0, < 5.37.0 |
| CVE-2024-52588 | 7.5 | May 29 | Strapi is an open-source content management system Affected: before 4.25.2 |
| CVE-2023-39345 | 7.5 | Nov 6 | strapi is an open-source headless CMS Affected: 4.0.0 before 4.13.1 |
| CVE-2023-34235 | 7.5 | Jul 25 | Strapi is an open-source headless content management system Affected: before 4.10.8 |
| CVE-2023-22893 | 7.5 | Apr 19 | Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication Affected: 3.0.0 before 4.6.0 |
| CVE-2022-30618 | 7.5 | May 19 | An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if content types accessible… Affected: 3.0.0 before 3.6.10; 4.0.0 before 4.1.10 |
| CVE-2021-46440 | 7.5 | May 3 | Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an attacker to access a victim's HTTP request,… Affected: before 3.6.9; 4.0.0 before 4.1.5 |
| CVE-2020-27665 | 7.5 | Oct 22 | In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB (aka content-type-builder) routes Affected: before 3.2.5 |
| CVE-2026-22599 | 7.2 | May 14 | Strapi Vulnerable to SQL Injection in Content Type Builder Affected: >= 5.0.0, < 5.33.2; >= 4.0.0, < 4.26.1 |
| CVE-2023-22621 | 7.2 | Apr 19 | Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server Affected: 3.0.0 before 4.5.6 |
| CVE-2019-19609 | 7.2 | Dec 5 | The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize… Affected: through 1.6.4; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +34 more |
| CVE-2023-34093 | 7.1 | Jul 25 | Strapi is an open-source headless content management system Affected: before 4.10.8 |
Showing 20