parse-community

Records159All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical22CVSS 9.0–10.0

CVSS high63CVSS 7.0–8.9

Exploited now

parse-community records in CISA KEV

No parse-community vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Parse-server 102 records HIGH Parse Dashboard 4 records MEDIUM Parse Javascript Sdk 1 record MEDIUM Parse Server 1 record LOW Parse Server Push Adapter 1 record LOW

Records

159 records

TI-2022-08574 CVE-2022-24760 · GHSA-p6h4-93qp-jhcm

Command Injection in Parse server

HIGH 82

Parse Server is an open source http web server backend.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.49362 Published 2022-03-11 Fixed in 4.10.7 CWE-74

TI-2024-18136 CVE-2024-27298 · GHSA-6927-3vr9-fxf2

Parse Server literalizeRegexPart SQL Injection

HIGH 76

parse-server is a Parse Server for Node.js / Express.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.0103 Published 2024-03-01 Fixed in 6.5.0, 7.0.0-alpha.20 CWE-89

TI-2022-18768 CVE-2022-39396 · GHSA-prm5-8g2m-24gg

Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser

HIGH 76

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.3935 Published 2022-11-10 Fixed in 4.10.18, 5.3.1 CWE-1321

TI-2024-31550 CVE-2024-47183 · GHSA-8xq9-g7ch-35hg

Parse Server's custom object ID allows to acquire role privileges

HIGH 70

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00416 Published 2024-10-04 Fixed in 6.5.9, 7.3.0 CWE-285

TI-2025-35510 CVE-2025-57324 · GHSA-9g8m-v378-pcg3

parse is a package designed to parse JavaScript SDK.

MEDIUM 62

parse is a package designed to parse JavaScript SDK.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00358 Published 2025-09-24 Fixed in 7.0.0-alpha.1 CWE-1321

TI-2024-26265 CVE-2024-39309 · GHSA-c2hr-cqg6-8j6r

ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability

MEDIUM 62

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.20171 Published 2024-07-01 Fixed in 6.5.7, 7.1.0 CWE-288

TI-2023-18316 CVE-2023-36475 · GHSA-462x-c3jw-7vr6

Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution

MEDIUM 55

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03203 Published 2023-06-28 Fixed in 5.5.2, 6.2.1 CWE-1321

TI-2026-23790 CVE-2026-30965 · GHSA-6r2j-cxgf-495f

Parse Server session token exfiltration via `redirectClassNameForKey` query parameter

MEDIUM 52

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0CRITICAL 9.9 Network No auth No interaction EPSS 0.01452 Published 2026-03-10 Fixed in 8.6.21, 9.5.2-alpha.8 CWE-863

TI-2026-24777 CVE-2026-32248 · GHSA-5fw2-8jcv-xh87

Parse Server: Account takeover via operator injection in authentication data identifier

MEDIUM 49

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00682 Published 2026-03-12 Fixed in 9.6.0-alpha.12, 8.6.38 CWE-943

TI-2026-24423 CVE-2026-31871 · GHSA-gqpp-xgvh-9h7h

Parse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL

MEDIUM 49

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00475 Published 2026-03-11 Fixed in 8.6.31, 9.6.0-alpha.5 CWE-89

TI-2026-24408 CVE-2026-31856 · GHSA-q3vj-96h2-gwvg

Parse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQL

MEDIUM 49

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00479 Published 2026-03-11 Fixed in 8.6.29, 9.6.0-alpha.3 CWE-89

TI-2026-24393 CVE-2026-31840 · GHSA-qpr4-jrj4-6f27

Parse Server has a SQL injection via dot-notation field name in PostgreSQL

MEDIUM 49

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00474 Published 2026-03-11 Fixed in 8.6.28, 9.6.0-alpha.2 CWE-89

TI-2026-23791 CVE-2026-30966 · GHSA-5f92-jrq3-28rc

Parse Server role escalation and CLP bypass via direct `_Join` table write

MEDIUM 49

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00436 Published 2026-03-10 Fixed in 8.6.20, 9.5.2-alpha.7 CWE-284

TI-2026-23692 CVE-2026-30863 · GHSA-x6fw-778m-wr9v

Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters

MEDIUM 49

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00584 Published 2026-03-07 Fixed in 8.6.10, 9.5.0-alpha.11 CWE-287

TI-2026-21981 CVE-2026-27595 · GHSA-qwc3-h9mg-4582

Parse Dashboard has incomplete authentication on AI Agent endpoint

MEDIUM 49

Parse Dashboard is a standalone dashboard for managing Parse Server apps.

CVSS 4.0CRITICAL 9.9 Network No auth No interaction EPSS 0.00511 Published 2026-02-25 Fixed in 9.0.0-alpha.8 CWE-306

TI-2026-22158 CVE-2026-27804 · GHSA-4q3h-vp4r-prv2

Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter

MEDIUM 47

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00201 Published 2026-02-25 Fixed in 9.3.1-alpha.4, 8.6.3 CWE-327

TI-2022-16502 CVE-2022-36079 · GHSA-2m6g-crv8-p3c6

Parse Server vulnerable to brute force guessing of user sensitive data via search patterns

MEDIUM 46

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.01283 Published 2022-09-07 Fixed in 4.10.14, 5.2.5 CWE-200

TI-2026-23771 CVE-2026-30946 · GHSA-cmj3-wx7h-ffvg

Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API

MEDIUM 45

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0062 Published 2026-03-10 Fixed in 8.6.15, 9.5.2-alpha.2 CWE-770

TI-2026-23764 CVE-2026-30939 · GHSA-5j86-7r7m-p8h6

Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution

MEDIUM 45

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.0057 Published 2026-03-10 Fixed in 8.6.13, 9.5.1-alpha.2 CWE-1321

TI-2022-20220 CVE-2022-41879 · GHSA-93vw-8fm5-p2jf

Parse Server subject to Prototype pollution via Cloud Code Webhooks

MEDIUM 45

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00977 Published 2022-11-10 Fixed in 4.10.20, 5.3.3 CWE-1321

TI-2022-20219 CVE-2022-41878 · GHSA-xprv-wvh7-qqqx

Parse Server Prototype pollution and Injection via Cloud Code Webhooks or Cloud Code Triggers

MEDIUM 45

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01056 Published 2022-11-10 Fixed in 4.10.19, 5.3.2 CWE-1321

TI-2022-13127 CVE-2022-31083 · GHSA-rh9j-f5f8-rvgc

Authentication bypass in Parse Server Apple Game Center auth adapter

MEDIUM 45

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00902 Published 2022-06-17 Fixed in 4.0.11, 5.2.2 +1 CWE-287

TI-2026-85949 CVE-2026-123487 · GHSA-r7pw-r949-xvmf

ReDoS in Parse Server email validation blocks the event loop

MEDIUM 44

Parse Server before 8.6.115 and 9.0.0 before 9.10.7-alpha.1 validates user email address format with a regular expression whose run time grows quadratically with input length and that is applied without a length limit.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00383 Published 2026-11-06 Fixed in 9.10.7-alpha.1, 8.6.115 CWE-1333

TI-2026-64791 CVE-2026-100631 · GHSA-fq69-3pm5-2h3g

Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection

MEDIUM 44

Parse Server is an open source backend server.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00357 Published 2026-09-26 Fixed in 9.10.1-alpha.9, 8.6.90 CWE-943

TI-2026-41396 CVE-2026-57480

Parse Server: Denial of service via exponential-time processing of deeply nested query operators

MEDIUM 44

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0059 Published 2026-07-08 Fixed in 9.9.1-alpha.12, 8.6.82 CWE-407

Open these records in search →