parse-community

Records159All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical22CVSS 9.0–10.0

CVSS high63CVSS 7.0–8.9

Exploited now

parse-community records in CISA KEV

No parse-community vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Parse-server 102 records HIGH Parse Dashboard 4 records MEDIUM Parse Javascript Sdk 1 record MEDIUM Parse Server 1 record LOW Parse Server Push Adapter 1 record LOW

Records

102 records in Parse-server · all components

TI-2022-08574 CVE-2022-24760 · GHSA-p6h4-93qp-jhcm

Command Injection in Parse server

HIGH 82

Parse Server is an open source http web server backend.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.49362 Published 2022-03-11 Fixed in 4.10.7 CWE-74

TI-2024-18136 CVE-2024-27298 · GHSA-6927-3vr9-fxf2

Parse Server literalizeRegexPart SQL Injection

HIGH 76

parse-server is a Parse Server for Node.js / Express.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.0103 Published 2024-03-01 Fixed in 6.5.0, 7.0.0-alpha.20 CWE-89

TI-2022-18768 CVE-2022-39396 · GHSA-prm5-8g2m-24gg

Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser

HIGH 76

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.3935 Published 2022-11-10 Fixed in 4.10.18, 5.3.1 CWE-1321

TI-2024-31550 CVE-2024-47183 · GHSA-8xq9-g7ch-35hg

Parse Server's custom object ID allows to acquire role privileges

HIGH 70

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00416 Published 2024-10-04 Fixed in 6.5.9, 7.3.0 CWE-285

TI-2023-18316 CVE-2023-36475 · GHSA-462x-c3jw-7vr6

Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution

MEDIUM 55

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03203 Published 2023-06-28 Fixed in 5.5.2, 6.2.1 CWE-1321

TI-2026-23790 CVE-2026-30965 · GHSA-6r2j-cxgf-495f

Parse Server session token exfiltration via `redirectClassNameForKey` query parameter

MEDIUM 52

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0CRITICAL 9.9 Network No auth No interaction EPSS 0.01452 Published 2026-03-10 Fixed in 8.6.21, 9.5.2-alpha.8 CWE-863

TI-2026-24777 CVE-2026-32248 · GHSA-5fw2-8jcv-xh87

Parse Server: Account takeover via operator injection in authentication data identifier

MEDIUM 49

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00682 Published 2026-03-12 Fixed in 9.6.0-alpha.12, 8.6.38 CWE-943

TI-2026-24423 CVE-2026-31871 · GHSA-gqpp-xgvh-9h7h

Parse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL

MEDIUM 49

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00475 Published 2026-03-11 Fixed in 8.6.31, 9.6.0-alpha.5 CWE-89

TI-2026-24408 CVE-2026-31856 · GHSA-q3vj-96h2-gwvg

Parse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQL

MEDIUM 49

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00479 Published 2026-03-11 Fixed in 8.6.29, 9.6.0-alpha.3 CWE-89

TI-2026-24393 CVE-2026-31840 · GHSA-qpr4-jrj4-6f27

Parse Server has a SQL injection via dot-notation field name in PostgreSQL

MEDIUM 49

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00474 Published 2026-03-11 Fixed in 8.6.28, 9.6.0-alpha.2 CWE-89

TI-2026-23791 CVE-2026-30966 · GHSA-5f92-jrq3-28rc

Parse Server role escalation and CLP bypass via direct `_Join` table write

MEDIUM 49

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00436 Published 2026-03-10 Fixed in 8.6.20, 9.5.2-alpha.7 CWE-284

TI-2026-23692 CVE-2026-30863 · GHSA-x6fw-778m-wr9v

Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters

MEDIUM 49

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00584 Published 2026-03-07 Fixed in 8.6.10, 9.5.0-alpha.11 CWE-287

TI-2026-22158 CVE-2026-27804 · GHSA-4q3h-vp4r-prv2

Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter

MEDIUM 47

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00201 Published 2026-02-25 Fixed in 9.3.1-alpha.4, 8.6.3 CWE-327

TI-2022-16502 CVE-2022-36079 · GHSA-2m6g-crv8-p3c6

Parse Server vulnerable to brute force guessing of user sensitive data via search patterns

MEDIUM 46

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.01283 Published 2022-09-07 Fixed in 4.10.14, 5.2.5 CWE-200

TI-2026-23771 CVE-2026-30946 · GHSA-cmj3-wx7h-ffvg

Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API

MEDIUM 45

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0062 Published 2026-03-10 Fixed in 8.6.15, 9.5.2-alpha.2 CWE-770

TI-2026-23764 CVE-2026-30939 · GHSA-5j86-7r7m-p8h6

Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution

MEDIUM 45

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.0057 Published 2026-03-10 Fixed in 8.6.13, 9.5.1-alpha.2 CWE-1321

TI-2022-20220 CVE-2022-41879 · GHSA-93vw-8fm5-p2jf

Parse Server subject to Prototype pollution via Cloud Code Webhooks

MEDIUM 45

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00977 Published 2022-11-10 Fixed in 4.10.20, 5.3.3 CWE-1321

TI-2022-20219 CVE-2022-41878 · GHSA-xprv-wvh7-qqqx

Parse Server Prototype pollution and Injection via Cloud Code Webhooks or Cloud Code Triggers

MEDIUM 45

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01056 Published 2022-11-10 Fixed in 4.10.19, 5.3.2 CWE-1321

TI-2022-13127 CVE-2022-31083 · GHSA-rh9j-f5f8-rvgc

Authentication bypass in Parse Server Apple Game Center auth adapter

MEDIUM 45

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00902 Published 2022-06-17 Fixed in 4.0.11, 5.2.2 +1 CWE-287

TI-2026-25931 CVE-2026-33538 · GHSA-g4cf-xj29-wqqr

Parse Server: Denial of service via unindexed database query for unconfigured auth providers

MEDIUM 44

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00422 Published 2026-03-24 Fixed in 8.6.58, 9.6.0-alpha.52 CWE-400

TI-2026-25894 CVE-2026-33498 · GHSA-9fjp-q3c4-6w3j

Parse Server: Query condition depth bypass via pre-validation transform pipeline

MEDIUM 44

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0047 Published 2026-03-24 Fixed in 8.6.55, 9.6.0-alpha.44 CWE-674

TI-2026-25392 CVE-2026-32944 · GHSA-9xp9-j92r-p88v

Parse Server crash via deeply nested query condition operators

MEDIUM 44

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00513 Published 2026-03-18 Fixed in 9.6.0-alpha.21, 8.6.45 CWE-674

TI-2026-24355 CVE-2026-31800 · GHSA-7xg7-rqf6-pw6c

Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes

MEDIUM 44

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00381 Published 2026-03-10 Fixed in 8.6.25, 9.5.2-alpha.12 CWE-862

TI-2026-23772 CVE-2026-30947 · GHSA-7ch5-98q2-7289

Parse Server ha a bypass of class-level permissions in LiveQuery

MEDIUM 44

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0047 Published 2026-03-10 Fixed in 8.6.16, 9.5.2-alpha.3 CWE-863

TI-2026-23766 CVE-2026-30941 · GHSA-vgjh-hmwf-c588

Parse Server has a NoSQL injection via token type in password reset and email verification endpoints

MEDIUM 44

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00518 Published 2026-03-10 Fixed in 8.6.14, 9.5.2-alpha.1 CWE-943

Open these records in search →