4.6 에 영향을 주는 CVE
| CVE | 제목 | CVSS | 악용 | EPSS | 공개일 |
|---|---|---|---|---|---|
| CVE-2023-22894 | Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by e... | 4.9 | KEV | 4.1% | 2023-04-19 |
| CVE-2023-38507 | Strapi Improper Rate Limiting vulnerability | 9.8 | — | 2023-09-15 | |
| CVE-2026-90561 | Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG | 9.3 | — | 2026-09-13 | |
| CVE-2026-22599 | Strapi Vulnerable to SQL Injection in Content Type Builder | 9.3 | — | 2026-05-14 | |
| CVE-2026-27886 | Strapi may leak sensitive data via relational filtering due to lack of query sanitization | 9.2 | — | 2026-05-14 | |
| CVE-2024-34065 | @strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass | 8.1 | — | 2024-06-12 | |
| CVE-2023-39345 | Unauthorized Access to Private Fields in User Registration API in strapi | 7.5 | — | 2023-11-06 | |
| CVE-2024-52588 | Strapi allows Server-Side Request Forgery in Webhook function | 7.5 | — | 2025-05-29 | |
| CVE-2023-34235 | Leaking sensitive user information still possible by filtering on private with prefix fields | 7.5 | — | 2023-07-25 | |
| CVE-2023-34093 | Strapi allows actors to make all attributes on a content-type public without noticing it | 7.1 | — | 2023-07-25 | |
| CVE-2025-64526 | Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying | 6.9 | — | 2026-05-14 | |
| CVE-2024-31217 | @strapi/plugin-upload has a Denial-of-Service via Improper Exception Handling | 6.5 | — | 2024-06-12 | |
| CVE-2025-53092 | Strapi core vulnerable to sensitive data exposure via CORS misconfiguration | 6.5 | — | 2025-10-16 | |
| CVE-2025-3930 | Lack of JWT Expiration after Log Out in Strapi | 6.3 | — | 2025-10-16 | |
| CVE-2025-25298 | Missing Maximum Password Length Validation in Strapi Password Hashing | 6.3 | — | 2025-10-16 | |
| CVE-2026-57997 | Strapi users-permissions - JWT Algorithm Confusion via Missing Algorithm Configuration | 6.3 | — | 2026-06-29 | |
| CVE-2023-36472 | Strapi may leak sensitive user information, user reset password, tokens via content-manager views | 5.7 | — | 2023-09-15 | |
| CVE-2026-22707 | Strapi Upload Plugin MIME Validation Bypass via Content API | 5.3 | — | 2026-05-14 | |
| CVE-2024-29181 | @strapi/plugin-content-manager leaks data via relations via the Admin Panel | 3.5 | — | 2024-06-12 | |
| CVE-2023-37263 | Strapi's field level permissions not being respected in relationship title | 2.7 | — | 2023-09-15 | |
| CVE-2026-22706 | Strapi: Password Reset Does Not Revoke Existing Refresh Sessions | 2.1 | — | 2026-05-14 |
내 서버의 버전을 직접 추적하세요
InfraGuard 는 모든 서버에 설치된 소프트웨어 버전을 수집하고, 알려진 취약점이 있는 버전을 알려 줍니다. 자체 호스팅이라 데이터가 내 네트워크를 벗어나지 않습니다.
데이터: CVE List(CVE® Program), NVD, CISA KEV, FIRST EPSS(EPSS 는 https://www.first.org/epss 참고), endoflife.date. 소프트웨어 목록: awesome-selfhosted(CC BY-SA 3.0).