HIGH CISA-KEV ACTIVELY EXPLOITED PoC

CVE-2023-22894

Strapi Cleartext Storage of Sensitive Information Vulnerability

Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.

Affected Products

References

Published: 2026-10-08 · Source: CISA-KEV · Feed updated: 2026-10-12
This high severity vulnerability was published on 2026-10-08 via CISA-KEV. ⚠ This vulnerability is in the CISA Known Exploited Vulnerabilities (KEV) catalog — it is being actively exploited in the wild. 🚨 A public proof-of-concept exploit is available on GitHub. Affected: Strapi: Strapi.

Risk Timeline

CVE Disclosed2026-10-08 · 4 days ago
Public PoC Exploit AvailableWeaponised proof-of-concept code is publicly accessible
CISA KEV — Actively ExploitedU.S. federal agencies required to patch · confirmed threat-actor activity

Remediation Resources

CISA / KEV
www.cisa.gov/known-exploited-vulnerabilities-catalog
NVD / MITRE
nvd.nist.gov/vuln/detail/CVE-2023-22894
vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.