Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

VulnScan

strapi Security Vulnerabilities | CyStack CVE Database

Vulnerability	Exploitation status	Fix	Affected product	Published	Severity

`CVE-2026-90561`Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG	Exploitation statusNot confirmed	FixYes	Affected productstrapi	Published09/13/2026	SeverityCritical
`CVE-2026-57997`Strapi users-permissions - JWT Algorithm Confusion via Missing Algorithm Configuration	Exploitation statusNot known exploited	FixYes	Affected productstrapi	Published06/29/2026	SeverityMedium
`CVE-2026-27886`Strapi may leak sensitive data via relational filtering due to lack of query sanitization	Exploitation statusNot known exploited	FixNot confirmed	Affected productstrapi	Published05/14/2026	SeverityCritical
`CVE-2026-22707`Strapi Upload Plugin MIME Validation Bypass via Content API	Exploitation statusNot known exploited	FixNot confirmed	Affected productstrapi	Published05/14/2026	SeverityMedium
`CVE-2026-22706`Strapi: Password Reset Does Not Revoke Existing Refresh Sessions	Exploitation statusNot known exploited	FixNot confirmed	Affected productstrapi	Published05/14/2026	SeverityLow
`CVE-2026-22599`Strapi Vulnerable to SQL Injection in Content Type Builder	Exploitation statusNot known exploited	FixNot confirmed	Affected productstrapi	Published05/14/2026	SeverityCritical
`CVE-2025-64526`Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying	Exploitation statusNot known exploited	FixNot confirmed	Affected productstrapi	Published05/14/2026	SeverityMedium
`CVE-2025-53092`Strapi core vulnerable to sensitive data exposure via CORS misconfiguration	Exploitation statusNot known exploited	FixYes	Affected productstrapi	Published10/16/2025	SeverityMedium
`CVE-2025-25298`Missing Maximum Password Length Validation in Strapi Password Hashing	Exploitation statusPublic exploit	FixYes	Affected productstrapi	Published10/16/2025	SeverityMedium
`CVE-2024-56143`Strapi Allows Unauthorized Access to Private Fields via parms.lookup	Exploitation statusPublic exploit	FixYes	Affected productstrapi	Published10/16/2025	SeverityHigh
`CVE-2025-3930`Lack of JWT Expiration after Log Out in Strapi	Exploitation statusNot known exploited	FixYes	Affected productstrapi	Published10/16/2025	SeverityMedium
`CVE-2024-52588`Strapi allows Server-Side Request Forgery in Webhook function	Exploitation statusPublic exploit	FixYes	Affected productstrapi	Published05/29/2025	SeverityMedium
`CVE-2024-37818`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published06/20/2024	SeverityHigh
`CVE-2024-34065`@strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass	Exploitation statusNot known exploited	FixNot confirmed	Affected productstrapi	Published06/12/2024	SeverityHigh
`CVE-2024-31217`@strapi/plugin-upload has a Denial-of-Service via Improper Exception Handling	Exploitation statusPublic exploit	FixNot confirmed	Affected productstrapi	Published06/12/2024	SeverityMedium
`CVE-2024-29181`@strapi/plugin-content-manager leaks data via relations via the Admin Panel	Exploitation statusPublic exploit	FixNot confirmed	Affected productstrapi	Published06/12/2024	SeverityLow
`CVE-2023-48218`Strapi Protected Populate Plugin leaking fields if the request fields where empty or only fields selected where not populatable	Exploitation statusNot confirmed	FixYes	Affected productstrapi-plugin-protected-populate	Published11/20/2023	SeverityMedium
`CVE-2023-39345`Unauthorized Access to Private Fields in User Registration API in strapi	Exploitation statusPublic exploit	FixNot confirmed	Affected productstrapi	Published11/06/2023	SeverityHigh
`CVE-2023-38507`Strapi Improper Rate Limiting vulnerability	Exploitation statusPublic exploit	FixNot confirmed	Affected productstrapi	Published09/15/2023	SeverityHigh
`CVE-2023-37263`Strapi's field level permissions not being respected in relationship title	Exploitation statusPublic exploit	FixNot confirmed	Affected productstrapi	Published09/15/2023	SeverityMedium
`CVE-2023-36472`Strapi may leak sensitive user information, user reset password, tokens via content-manager views	Exploitation statusPublic exploit	FixYes	Affected productstrapi	Published09/15/2023	SeverityMedium
`CVE-2023-34235`Leaking sensitive user information still possible by filtering on private with prefix fields	Exploitation statusPublic exploit	FixNot confirmed	Affected productstrapi	Published07/25/2023	SeverityHigh
`CVE-2023-34093`Strapi allows actors to make all attributes on a content-type public without noticing it	Exploitation statusPublic exploit	FixNot confirmed	Affected productstrapi	Published07/25/2023	SeverityMedium
`CVE-2023-22894`	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published04/19/2023	SeverityCritical
`CVE-2023-22893`	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published04/19/2023	SeverityHigh
`CVE-2023-22621`	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published04/19/2023	SeverityCritical
`CVE-2022-31367`	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published09/27/2022	SeverityHigh
`CVE-2022-32114`	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published07/13/2022	SeverityUnknown
`CVE-2022-29894`	Exploitation statusNot confirmed	FixNot confirmed	Affected productstrapi	Published06/13/2022	SeverityUnknown
`CVE-2022-30618`	Exploitation statusNot confirmed	FixNot confirmed	Affected productstrapi	Published05/19/2022	SeverityUnknown
`CVE-2022-30617`	Exploitation statusNot confirmed	FixNot confirmed	Affected productstrapi	Published05/19/2022	SeverityUnknown
`CVE-2021-46440`	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published05/03/2022	SeverityUnknown
`CVE-2022-27263`	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published04/12/2022	SeverityUnknown
`CVE-2022-0764`Arbitrary Command Injection in strapi/strapi	Exploitation statusNot confirmed	FixYes	Affected productstrapi/strapi	Published02/26/2022	SeverityMedium
`CVE-2021-28128`	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published05/06/2021	SeverityUnknown
`CVE-2020-27664`	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published10/22/2020	SeverityUnknown
`CVE-2020-27665`	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published10/22/2020	SeverityUnknown
`CVE-2020-27666`	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published10/22/2020	SeverityUnknown
`CVE-2020-13961`	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published06/19/2020	SeverityUnknown
`CVE-2020-8123`	Exploitation statusNot confirmed	FixNot confirmed	Affected productStrapi	Published02/04/2020	SeverityUnknown
`CVE-2019-19609`	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published12/05/2019	SeverityUnknown
`CVE-2019-18818`	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published11/07/2019	SeverityUnknown

42 / 42 Results

All vulnerabilities loaded

Security vulnerabilities from strapi

strapi

How many security vulnerabilities does strapi have?

Which strapi product has the most security vulnerabilities?

Filters

Run an in-depth assessment with complete web risk management

Popular strapi products

strapi

@strapi/plugin-users-permissions

@strapi/admin

@strapi/content-type-builder

strapi/strapi

@strapi/upload