CVE Browser

Parse Server - Unreviewed Code Execution via Malicious Version Tags

Parse Server: MFA SMS one-time password accepted twice under concurrent login

Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`

Parse Server has a login timing side-channel reveals user existence

Parse Server has a file upload Content-Type override via extension mismatch

Parse Server: Streaming file download bypasses afterFind file trigger authorization

Parse Server: Auth data exposed via verify password endpoint

Parse Server: LiveQuery protected-field guard bypass via array-like logical operator value

Parse Server: Session field immutability bypass via falsy-value guard

Parse Server: GraphQL complexity validator exponential fragment traversal DoS

Parse Server: Cloud function validator bypass via prototype chain traversal

Parse Server: GraphQL API endpoint ignores CORS origin restriction

Parse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribers

Parse Server: MFA single-use token bypass via concurrent authData login requests

Parse Server: Auth data exposed via /users/me endpoint

Parse Server: MFA recovery code single-use bypass via concurrent requests

Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter

Parse Server: Denial of service via unindexed database query for unconfigured auth providers

Parse Server: Session update endpoint allows overwriting server-generated session fields

Parse Server: LiveQuery subscription query depth bypass

Parse Server: Query condition depth bypass via pre-validation transform pipeline

Parse Server: Protected field change detection oracle via LiveQuery watch parameter

Parse Server: LiveQuery bypasses CLP pointer permission enforcement

Parse Server: Auth provider validation bypass on login via partial authData

Parse Server: Email verification resend page leaks user existence