CVE-2026-30228 Parse Server: File creation and deletion bypasses `readOnlyMasterKey` write restriction

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.5 and 9.5.0-alpha.3, the readOnlyMasterKey can be used to create and delete files via the Files API POST /files/:filename, DELETE /files/:filename. This bypasses the...

CVE-2026-29087

creationtimestamp| type| source ---|---|--- 2026-03-06 19:57:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgg3uyapxa2o 2026-03-07 09:30:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mghjdj5siw2v 2026-04-15 07:07:08+00:00| seen|...

CVE-2025-69645

creationtimestamp| type| source ---|---|--- 2026-03-06 19:08:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgfz54gk7a24 2026-03-19 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/...

CVE-2025-69646

creationtimestamp| type| source ---|---|--- 2026-03-06 19:06:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgfyzcq7bb2d 2026-03-19 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/...

EUVD-2026-10059

parse-server's file creation and deletion bypasses readOnlyMasterKey write restriction...

GHSA-G8R9-G2V8-JV6F

creationtimestamp| type| source ---|---|--- 2026-03-06 17:10:06+00:00| seen| https://gist.github.com/alon710/4e3441e930710881f9a07d433f110f07...

CVE-2026-29783

creationtimestamp| type| source ---|---|--- 2026-03-06 16:10:31+00:00| published-proof-of-concept| https://github.com/github/copilot-cli/security/advisories/GHSA-g8r9-g2v8-jv6f 2026-03-06 17:10:06+00:00| seen| https://gist.github.com/alon710/4e3441e930710881f9a07d433f110f07 2026-03-06...

EUVD-2018-21652

OOP CMS BLOG 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by crafting malicious POST requests. Attackers can submit forms to the addUser.php endpoint with parameters including userName, password, email, and ro...

EUVD-2018-21623

Precurio Intranet Portal 2.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by submitting crafted POST requests. Attackers can forge requests to the /public/admin/user/submitnew endpoint with user creation parameter...

CVE-2026-3236

In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key having a lifetime exceeding the original API key used to mint the access token...

CVE-2018-25187

creationtimestamp| type| source ---|---|--- 2026-03-06 14:27:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgfjgotpwz2y...

CVE-2018-25173

creationtimestamp| type| source ---|---|--- 2026-03-06 14:11:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgfil6jjyv2o...

CVE-2018-25200

OOP CMS BLOG 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by crafting malicious POST requests. Attackers can submit forms to the addUser.php endpoint with parameters including userName, password, email, and ro...

CVE-2018-25168

Precurio Intranet Portal 2.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by submitting crafted POST requests. Attackers can forge requests to the /public/admin/user/submitnew endpoint with user creation parameter...

CVE-2026-28713

creationtimestamp| type| source ---|---|--- 2026-03-06 13:03:05+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-acronis...

CVE-2018-25200 OOP CMS BLOG 1.0 Cross-Site Request Forgery via addUser.php

OOP CMS BLOG 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by crafting malicious POST requests. Attackers can submit forms to the addUser.php endpoint with parameters including userName, password, email, and ro...

CVE-2018-25200

CVE-2018-25200 concerns OOP CMS BLOG 1.0 with a cross-site request forgery that lets unauthenticated attackers craft POST requests to addUser.php (parameters: userName, password, email, role) to create an administrative account. Connected sources consistently describe the flaw and its target endp...

CVE-2018-25200 OOP CMS BLOG 1.0 Cross-Site Request Forgery via addUser.php

OOP CMS BLOG 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by crafting malicious POST requests. Attackers can submit forms to the addUser.php endpoint with parameters including userName, password, email, and ro...

CVE-2018-25190 Easyndexer 1.0 Cross-Site Request Forgery via createuser.php

Easyndexer 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative accounts by submitting forged POST requests. Attackers can craft malicious web pages that submit POST requests to createuser.php with parameters including username,...

CVE-2018-25190 Easyndexer 1.0 Cross-Site Request Forgery via createuser.php

Easyndexer 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative accounts by submitting forged POST requests. Attackers can craft malicious web pages that submit POST requests to createuser.php with parameters including username,...