1614 matches found
CVE-2022-24760
CVE-2022-24760 flow 기본적으로 db에 클래스를 추가/삭제/수정할 때 key가 필요하지 않음 Diff commit https://github.com/parse-community/parse-server/commit/886bfd7cac69496e3f73d4bb536f0eec3cba0e4d Prototype pollution은 expandResultOnKeyPath 함수에서 발생 root@kitploit: DatabaseController.js sanitizeDatabaseResult -...
Parse Server < 8.6.21 / 9.x < 9.5.2 - Session Token Exfiltration
Parse Server 8.6.21 / 9.x 9.5.2 contains an information disclosure vulnerability caused by improper handling of the redirectClassNameForKey query parameter, letting authenticated or unauthenticated attackers exfiltrate session tokens, exploit requires ability to create or update an object with a...
POC_SQL_injection_in_Parse_Server_prior_6.5.7_-_7.1.0
Database Ghost 🔥 Fortgeschrittenes PostgreSQL SQL-Injection-Exploitation-Tool 🚨 HAFTUNGSAUSSCHLUSS NUR FÜR AUTORISIERTE SICHERHEITSTESTS Unbefugte Nutzung ist illegal. Verwenden Sie das Tool nur auf Systemen, die Ihnen gehören oder für deren Tests Sie eine ausdrückliche Genehmigung haben. ⚡...
Information Exposure
Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Information Exposure via the GraphQL error message handling process. An attacker can obtain the names of required custom inp...
@openinc/parse-server-opendash (>=4.0.0, <=4.1.1) potentially affected by CVE-2026-66009 via parse-server (>=9.6.0-alpha.37, <=9.9.1-alpha.13)
parse-server NPM version =9.6.0-alpha.37, =4.0.0, =4.1.1 Source cves: CVE-2026-66009 Source advisory: SNYK:JS-PARSESERVER-18306805...
Information Exposure
Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Information Exposure via error messages generated during GraphQL validation and input-coercion. An attacker can obtain...
@openinc/parse-server-opendash (>=4.0.0, <=4.1.1) potentially affected by CVE-2026-66008 via parse-server (>=9.6.0-alpha.37, <=9.9.1-alpha.13)
parse-server NPM version =9.6.0-alpha.37, =4.0.0, =4.1.1 Source cves: CVE-2026-66008 Source advisory: SNYK:JS-PARSESERVER-18306804...
CVE-2026-66009
Parse Server versions = 9.0.0 before 9.10.0-alpha.5 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id ...
CVE-2026-66008
Parse Server versions = 9.0.0 before 9.10.0-alpha.6 and = 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled graphQLPublicIntrospection: false, the default. Because these...
EUVD-2026-48581
Parse Server versions = 9.0.0 before 9.10.0-alpha.5 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id ...
CVE-2026-66009 Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages
Parse Server versions = 9.0.0 before 9.10.0-alpha.5 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id ...
CVE-2026-66009 Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages
Parse Server versions = 9.0.0 before 9.10.0-alpha.5 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id ...
CVE-2026-66009 Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages
Parse Server versions = 9.0.0 before 9.10.0-alpha.5 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id ...
CVE-2026-66009
Parse Server versions = 9.0.0 before 9.10.0-alpha.5 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id ...
CVE-2026-66009
Parse Server versions >= 9.0.0 before 9.10.0-alpha.5 and >= 8.2.2 before 8.6.86 expose GraphQL validation error messages that reveal required custom input field names when public introspection is disabled (graphQLPublicIntrospection: false by default). A client with only the public applicat...
CVE-2026-66008 Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages
Parse Server versions = 9.0.0 before 9.10.0-alpha.6 and = 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled graphQLPublicIntrospection: false, the default. Because these...
CVE-2026-66008
Parse Server versions >= 9.0.0 before 9.10.0-alpha.6 and >= 8.2.2 before 8.6.87 expose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled (graphQLPublicIntrospection: false). Since errors are prod...
EUVD-2026-48580
Parse Server versions = 9.0.0 before 9.10.0-alpha.6 and = 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled graphQLPublicIntrospection: false, the default. Because these...
CVE-2026-66008 Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages
Parse Server versions = 9.0.0 before 9.10.0-alpha.6 and = 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled graphQLPublicIntrospection: false, the default. Because these...
CVE-2026-66008
Parse Server versions = 9.0.0 before 9.10.0-alpha.6 and = 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled graphQLPublicIntrospection: false, the default. Because these...