PT-2026-24227

🗓️ 10 Mar 2026 00:00:00Reported by Positive TechnologiesType

NoSQL injection in Parse Server before 8.6.14 and 9.5.2-alpha.1 allows unauthenticated token extraction via reset and email verification.

Reporter	Title	Published	Views	Family All 15
ATTACKERKB	CVE-2026-30941	10 Mar 202616:40	–	attackerkb
CNNVD	Parse Server 安全漏洞	10 Mar 202600:00	–	cnnvd
CVE	CVE-2026-30941	10 Mar 202616:40	–	cve
Cvelist	CVE-2026-30941 Parse Server has a NoSQL injection via token type in password reset and email verification endpoints	10 Mar 202616:40	–	cvelist
EUVD	EUVD-2026-10551	11 Mar 202600:16	–	euvd
EUVD	EUVD-2026-10552	11 Mar 202600:16	–	euvd
Github Security Blog	Parse Server has a NoSQL injection via token type in password reset and email verification endpoints	11 Mar 202600:16	–	github
NVD	CVE-2026-30941	10 Mar 202618:18	–	nvd
OSV	BIT-PARSE-2026-30941 Parse Server has a NoSQL injection via token type in password reset and email verification endpoints	12 Mar 202614:47	–	osv
OSV	CVE-2026-30941 Parse Server has a NoSQL injection via token type in password reset and email verification endpoints	10 Mar 202616:40	–	osv

Source	Link
github	www.github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.1
twitter	www.twitter.com/CVEnew/status/2034136484681306280
twitter	www.twitter.com/infoflowcloud/status/2034138060447686822
osv	www.osv.dev/vulnerability/BIT-parse-2026-30941
osv	www.osv.dev/vulnerability/GHSA-vgjh-hmwf-c588
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30941.json
github	www.github.com/parse-community/parse-server/security/advisories/GHSA-vgjh-hmwf-c588
github	www.github.com/parse-community/parse-server/releases/tag/8.6.14
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-30941
osv	www.osv.dev/vulnerability/CVE-2026-30941

18 Mar 2026 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 48.7

CVSS 3.17.5

EPSS0.00059

SSVC