Corrigé dans
CVE affectant 3.2
| CVE | Titre | CVSS | Exploitée | EPSS | Publication |
|---|---|---|---|---|---|
| CVE-2023-22894 | Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by e... | 4.9 | KEV | 4.1% | 2023-04-19 |
| CVE-2022-27263 | An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute... | 9.8 | — | 2022-04-12 | |
| CVE-2020-27664 | admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functi... | 9.8 | — | 2020-10-22 | |
| CVE-2023-38507 | Strapi Improper Rate Limiting vulnerability | 9.8 | — | 2023-09-15 | |
| CVE-2022-30617 | An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email... | 8.8 | — | 2022-05-19 | |
| CVE-2022-31367 | Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses. | 8.8 | — | 2022-09-27 | |
| CVE-2024-34065 | @strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass | 8.1 | — | 2024-06-12 | |
| CVE-2021-28128 | In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the curren... | 8.1 | — | 2021-05-06 | |
| CVE-2024-52588 | Strapi allows Server-Side Request Forgery in Webhook function | 7.5 | — | 2025-05-29 | |
| CVE-2020-27665 | In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB (aka content-type-builder) route... | 7.5 | — | 2020-10-22 | |
| CVE-2023-34235 | Leaking sensitive user information still possible by filtering on private with prefix fields | 7.5 | — | 2023-07-25 | |
| CVE-2022-30618 | An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email... | 7.5 | — | 2022-05-19 | |
| CVE-2023-22893 | Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito... | 7.5 | — | 2023-04-19 | |
| CVE-2021-46440 | Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x... | 7.5 | — | 2022-05-03 | |
| CVE-2023-22621 | Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execu... | 7.2 | — | 2023-04-19 | |
| CVE-2023-34093 | Strapi allows actors to make all attributes on a content-type public without noticing it | 7.1 | — | 2023-07-25 | |
| CVE-2025-64526 | Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying | 6.9 | — | 2026-05-14 | |
| CVE-2022-0764 | Arbitrary Command Injection in strapi/strapi | 6.7 | — | 2022-02-26 | |
| CVE-2024-31217 | @strapi/plugin-upload has a Denial-of-Service via Improper Exception Handling | 6.5 | — | 2024-06-12 | |
| CVE-2025-53092 | Strapi core vulnerable to sensitive data exposure via CORS misconfiguration | 6.5 | — | 2025-10-16 | |
| CVE-2025-3930 | Lack of JWT Expiration after Log Out in Strapi | 6.3 | — | 2025-10-16 | |
| CVE-2025-25298 | Missing Maximum Password Length Validation in Strapi Password Hashing | 6.3 | — | 2025-10-16 | |
| CVE-2026-57997 | Strapi users-permissions - JWT Algorithm Confusion via Missing Algorithm Configuration | 6.3 | — | 2026-06-29 | |
| CVE-2023-36472 | Strapi may leak sensitive user information, user reset password, tokens via content-manager views | 5.7 | — | 2023-09-15 | |
| CVE-2020-27666 | Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature. | 5.4 | — | 2020-10-22 | |
| CVE-2026-22707 | Strapi Upload Plugin MIME Validation Bypass via Content API | 5.3 | — | 2026-05-14 | |
| CVE-2022-29894 | Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function... | 4.8 | — | 2022-06-13 | |
| CVE-2024-29181 | @strapi/plugin-content-manager leaks data via relations via the Admin Panel | 3.5 | — | 2024-06-12 | |
| CVE-2023-37263 | Strapi's field level permissions not being respected in relationship title | 2.7 | — | 2023-09-15 | |
| CVE-2026-22706 | Strapi: Password Reset Does Not Revoke Existing Refresh Sessions | 2.1 | — | 2026-05-14 |
Suivez ces versions sur vos propres serveurs
InfraGuard collecte les versions logicielles installées sur chaque serveur et signale celles qui présentent des vulnérabilités connues. Auto-hébergé : rien ne quitte votre réseau.
Données : CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (voir EPSS sur https://www.first.org/epss), endoflife.date. Liste des logiciels : awesome-selfhosted (CC BY-SA 3.0).