CVE-2023-22621

Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a crafted payload that executes code on the server into an email template that bypasses the validation checks that should prevent code execution.

• CWE-74
• CWE-74

• https://github.com/strapi/strapi/releasesRelease Notes
• https://strapi.io/blog/security-disclosure-of-vulnerabilities-cveVendor Advisory
• https://www.ghostccamm.com/blog/multi_strapi_vulns/Exploit, Third Party Advisory
• https://github.com/strapi/strapi/releasesRelease Notes
• https://strapi.io/blog/security-disclosure-of-vulnerabilities-cveVendor Advisory
• https://www.ghostccamm.com/blog/multi_strapi_vulns/Exploit, Third Party Advisory

Published

Apr 19, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-22615An issue was discovered in IhisiSmm in Insyde InsydeH2O with…8.4
• CVE-2023-22616An issue was discovered in Insyde InsydeH2O with kernel 5.2 …7.8
• CVE-2023-22617A remote attacker might be able to cause infinite recursion …7.5
• CVE-2023-22618If Security Hardening guide rules are not followed, then Nok…7.8
• CVE-2023-2262 A buffer overflow vulnerability exists in the Rockwell Au…9.8
• CVE-2023-22620An issue was discovered in SecurePoint UTM before 12.2.5.1. …7.5
• CVE-2023-22622WordPress through 6.1.1 depends on unpredictable client visi…5.3
• CVE-2023-22624Zoho ManageEngine Exchange Reporter Plus before 5708 allows …7.5
• CVE-2023-22626PgHero before 3.1.0 allows Information Disclosure via EXPLAI…7.5
• CVE-2023-22629An issue was discovered in TitanFTP through 1.94.1205. The m…8.8
• CVE-2023-2263 The Rockwell Automation Kinetix 5700 DC Bus Power Supply Se…7.5
• CVE-2023-22630IzyBat Orange casiers before 20221102_1 allows SQL Injection…4.3