parseplatform parse server vulnerabilities

Latest parseplatform parse server CVEs

Newest publication first

1. CVE-2023-22474 Parse Server is vulnerable to authentication bypass via spoofing

   Published 2023-02-03

   High·CVSS 8.1 EPSS 0.66%

   Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server uses the request header x-forwarded-for to determine the client IP address. If Parse Server doesn't run behind a proxy server, then a client can set this header an...

2. CVE-2020-15126 Information disclosure through Viewer query in parse-server

   Published 2020-07-22

   Medium·CVSS 6.5 EPSS 1.1%

   In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.