Data

Tools

Indexes

Applications

Experiments

Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

npm

strapi

npm

An open source headless CMS solution to create and manage your own API. It provides a powerful dashboard and features to make your life easier. Databases supported: MongoDB, MySQL, MariaDB, PostgreSQL, SQLite

View on github.com · View on npmjs.org

Security Advisories for strapi in npm

Potential
High
10 months ago

Strapi core vulnerable to sensitive data exposure via CORS misconfiguration GSA_kwCzR0hTQS05MzI5LW14eHctcXdmOM4ABNf8

npm @strapi/core
Potential
Moderate
10 months ago

Strapi Password Hashing is Missing Maximum Password Length Validation GSA_kwCzR0hTQS0yY2p2LTZ3ZzktZjRmM84ABNf7

npm @strapi/core
Potential
High
10 months ago

Strapi Allows Unauthorized Access to Private Fields via parms.lookup GSA_kwCzR0hTQS00OTVqLWg0OTMtNDJxMs4ABNff

npm @strapi/core
Likely fork
High
almost 3 years ago

Unauthorized Access to Private Fields in User Registration API GSA_kwCzR0hTQS1nYzdwLWo1eG0teHhoMs4AA26o

npm @strapi/strapi, @strapi/plugin-users-permissions
Potential
Moderate
almost 3 years ago

Strapi may leak sensitive user information, user reset password, tokens via content-manager views GSA_kwCzR0hTQS12OGdnLTRtcTItODhxNM4AA12r

npm @strapi/utils, @strapi/admin, @strapi/plugin-content-manager
Likely fork
Moderate
about 3 years ago

Making all attributes on a content-type public without noticing it GSA_kwCzR0hTQS1jaG1yLXJnMmYtOWptZs4AA04b

npm @strapi/database, @strapi/utils, @strapi/strapi
Potential
Critical
over 3 years ago

Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin GSA_kwCzR0hTQS0yaDg3LTRxMnctdjRoZs4AAy4o

npm @strapi/plugin-email, @strapi/plugin-users-permissions
Potential
High
over 3 years ago

Authentication Bypass in @strapi/plugin-users-permissions GSA_kwCzR0hTQS14djNxLWpybW0tNGZ4ds4AAy3O

npm @strapi/plugin-users-permissions
High
almost 4 years ago

Strapi mishandles hidden attributes within admin API responses GSA_kwCzR0hTQS00cGhnLWhwcW0tYzNqNM4AAvGG

npm @strapi/strapi, strapi
Moderate
about 4 years ago

Cross-site Scripting in Strapi GSA_kwCzR0hTQS1tY3FtLTZmZjQtNTNxeM4AArjX

npm strapi
Moderate
about 4 years ago

Improper Input Validation in strapi GSA_kwCzR0hTQS02NXd2LTUyOHItbTg5Ms4AAlF4

npm strapi
High
about 4 years ago

Improper Removal of Sensitive Information Before Storage or Transfer in Strapi GSA_kwCzR0hTQS12Z2o3LTg5NWotZ3ByNs4AAgbK

npm @strapi/strapi, strapi
High
about 4 years ago

Improper Removal of Sensitive Information Before Storage or Transfer in Strapi GSA_kwCzR0hTQS1mNmZtLXIyNnEtcDc0N84AAgbL

npm @strapi/strapi, strapi
High
over 4 years ago

Insecure password handling vulnerability in Strapi GSA_kwCzR0hTQS04NXZnLWdycjUtcHc0Ms3dNw

npm @strapi/strapi, strapi
Critical
over 4 years ago

Unrestricted Upload of File with Dangerous Type in Strapi GSA_kwCzR0hTQS05cWdtLXc4N3EtaHg4Oc06zg

npm strapi
Moderate
over 4 years ago

Command injection in strapi GSA_kwCzR0hTQS14cmpmLXBodnYtcjR2cs0vLg

npm strapi
Potential
Moderate
over 4 years ago

Uncontrolled Resource Consumption in strapi MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTIzZnAtZm1ydi1mNXB4

npm strapi-admin
High
almost 5 years ago

Weak Password Recovery Mechanism for Forgotten Password in Strapi GSA_kwCzR0hTQS0zN2h4LTRtY3Etd2MzaM0WMQ

npm strapi
Critical
over 5 years ago

Authorization bypass in Strapi MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTdmcnYtOXBody12cnZy

npm strapi
Potential
High
almost 6 years ago

Improper Authorization in Strapi MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTRwNTUteGozNy1meDdn

npm strapi-plugin-content-type-builder
High
almost 6 years ago

Command Injection in strapi MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTlwMnctcm14NC05bXc3

npm strapi
Critical
over 6 years ago

Strapi allows unauthenticated attacker to reset admin password without valid reset token MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTZ4YzItbWozOS1xNTk5

npm strapi

Filter by Severity

High 11 Moderate 7 Critical 4