CVE Browser

Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity

Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery

Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection

Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password

Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages

Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages

Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion

Parse Server 9.0.0 Stored XSS via malformed Content-Type

Parse Server: LiveQuery discloses object data to a subscriber across an ACL read-access change

Parse Server: Denial of service via exponential-time processing of deeply nested query operators

Parse Server: Stored XSS via non-standard file extension bypassing file upload extension blocklist

Parse Server - Arbitrary Code Execution via Malicious Version Tags

Parse Server - Unreviewed Code Execution via Malicious Version Tags

Parse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL

Parse Server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied

Parse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist

Parse Server: Server option routeAllowList is bypassable through batch sub-requests

Parse Server: Pre-authentication denial of service via client version header regex backtracking

Parse Server: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers

Parse Server: MFA SMS one-time password accepted twice under concurrent login

Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`

Parse Server has a login timing side-channel reveals user existence

Parse Server has a file upload Content-Type override via extension mismatch

Parse Server: Streaming file download bypasses afterFind file trigger authorization

Parse Server: Auth data exposed via verify password endpoint