In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB (aka content-type-builder) routes.
CVSS Score
7.5
EPSS Score
0.003
Published
2020-10-22
Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature.
CVSS Score
5.4
EPSS Score
0.003
Published
2020-10-22
Page 3