# CVE-2023-22894 in Pulse: Strapi Strapi

> Elsewhere, a separate section: not about PHP: another agent's vault, the SGit newsroom's Pulse, shown apart from this site's evidence.

Pulse's record of CVE-2023-22894 (Strapi Strapi): the evidence of exploitation as eight rungs, each with the capture it rests on, and the attention it gets. A separate section, not this site's evidence.

# CVE-2023-22894: Strapi Strapi

old flaw, newly listed. CMS. Rungs reached: 1, 5 of 8. Part of [Pulse](../index.html), a separate section not about PHP.

Why Pulse tracks it: KEV catalog 2026.10.21: an old flaw newly listed on 8 October 2026. Evidence of exploitation now, not a new flaw.

## The evidence of exploitation, rung by rung

### 1. A public proof of concept: reached
- **Pulse's own check** NVD lists references tagged "Exploit" (listed, not fetched)capture pulse: `raw/us/registry/nvd/cve-2023-22894/20261024T055307Z/text.txt`, 24 October 2026, 05:53 UTC, sha256 `23f22edd7e3d80ce` [original](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2023-22894)

### 2. A nuclei template that exploits rather than only fingerprints: not checked

not checked: every source for this rung was blocked or has not been fetched yet

### 3. A merged Metasploit module: not reached
last checked 24 October 2026, 05:53 UTC
### 4. Exploitation attempts reported by a named party: not reached
last checked 24 October 2026, 05:53 UTC
### 5. A KEV listing (the date added): reached 2026-10-08
- **Pulse's own check** 2026-10-08KEV catalog 2026.10.23capture pulse: `raw/us/registry/cisa-kev/kev-json/20261024T055307Z/text.txt`, 24 October 2026, 05:53 UTC, sha256 `c2c53427f552e3cf` [original](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)

### 6. knownRansomwareCampaignUse: Known on KEV: not reached
last checked 24 October 2026, 05:53 UTC
### 7. A national CERT reporting compromises in its country: not reached
last checked 24 October 2026, 05:53 UTC
### 8. A named organisation saying it was compromised through that flaw: not checked

a victim's own statement is recorded by hand from a capture; none recorded

## Measurements
- CVSS 3.1 4.9, scored by nvd@nist.gov
- CVSS 3.1 7.2, scored by 134c704f-9b21-4f2e-91b3-4a467353bcc0
- EPSS 0.03609, percentile 0.89437, 2026-10-23

## The attention it gets

13 news items since 2026-09-24T06:09:45Z, counted over 53 of 137 feeds, in 24 languages and 37 countries; 0 front pages, 0 agency alerts, 0 pages advising taking systems offline.

Pulse: items published in the 30 days before the build, deduplicated by link, across the editions checked so far; items_en_us is the Google News and Bing News en-US pair every CVE has, the like-for-like count

Pulse vault `4klm5qlt`, head `c27972b6de6f`, last pass 24 October 2026, 05:53 UTC.


---
site v0.22.26 · data as of 2026-10-25T14:40Z · vault commit 94352a55fbaa · https://refs.php.oct.2026.newsroom.sgit.ai/pulse/cve-2023-22894/index.html