parse community vulnerabilities

Products

• parse server 4

Latest parse community CVEs

Newest publication first

1. CVE-2024-47183 Parse Server's custom object ID allows to acquire role privileges

   Published 2024-10-04

   High·CVSS 8.1

   Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. If the Parse Server option allowCustomObjectId: true is set, an attacker that is allowed to create a new user can set a custom object ID for that new user that exploits the vul...

2. CVE-2024-39309 ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability

   Published 2024-07-01

   Critical·CVSS 9.8

   Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A vulnerability in versions prior to 6.5.7 and 7.1.0 allows SQL injection when Parse Server is configured to use the PostgreSQL database. The algorithm to detect SQL injection...

3. CVE-2024-29027 Parse Server crash and RCE via invalid Cloud Function or Cloud Job name

   Published 2024-03-19

   Critical·CVSS 9.1

   Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 6.5.5 and 7.0.0-alpha.29, calling an invalid Parse Server Cloud Function name or Cloud Job name crashes the server and may allow for code injection, internal...

4. CVE-2023-46119 Parse Server may crash when uploading file without extension

   Published 2023-10-25

   High·CVSS 7.5

   Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server crashes when uploading a file without extension. This vulnerability has been patched in versions 5.5.6 and 6.3.1.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.