Parse-community vulnerabilities
157 CVEs and advisories name Parse-community as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-68150Parse Server has Server-Side Request Forgery (SSRF) in Instagram OAuth Adapter
- CVE-2025-68115Parse Server vulnerable to Cross-Site Scripting (XSS) via Unescaped Mustache Template Variables
- CVE-2025-67727Parse Server GitHub CI workflow vulnerable to RCE through Improper Privilege Management
- CVE-2025-64502Parse Server allows public `explain` queries which may expose sensitive database performance information and schema details
- CVE-2025-64430Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format
- CVE-2025-62374Parse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIs
- CVE-2025-53364Parse Server exposes the data schema via GraphQL API
- CVE-2025-30168Parse Server has an OAuth login vulnerability
- CVE-2024-47183Parse Server's custom object ID allows to acquire role privileges
- CVE-2024-39309ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability
- CVE-2024-29027Parse Server crash and RCE via invalid Cloud Function or Cloud Job name
- CVE-2024-27298Parse Server literalizeRegexPart SQL Injection
- CVE-2023-46119Parse Server may crash when uploading file without extension
- CVE-2023-41058Trigger `beforeFind` not invoked in internal query pipeline in parse-server
- CVE-2023-36475Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution
- CVE-2023-32689Parse Server vulnerable to phishing attack vulnerability that involves uploading malicious HTML file
- CVE-2023-32688Invalid push request payload crashes Parse Server
- CVE-2023-22474Parse Server is vulnerable to authentication bypass via spoofing
- CVE-2022-41879Parse Server subject to Prototype pollution via Cloud Code Webhooks
- CVE-2022-41878Parse Server Prototype pollution and Injection via Cloud Code Webhooks or Cloud Code Triggers
- CVE-2022-39396Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser
- CVE-2022-39313Parse Server crashes when receiving file download request with invalid byte range
- CVE-2022-39231Parse Server subject to Improper Authentication allowing Auth adapter app ID validation to be circumvented
- CVE-2022-39225Parse Server subject to Incorrect Resource Transfer Between Spheres
- CVE-2022-36079Parse Server vulnerable to brute force guessing of user sensitive data via search patterns
- CVE-2022-31112Protected fields exposed via LiveQuery in parse-server
- CVE-2022-31089Invalid file request can crashe parse-server
- CVE-2022-31083Authentication bypass in Parse Server Apple Game Center auth adapter
- CVE-2022-24901Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter
- CVE-2022-24760Command Injection in Parse server