CVE-2026-121413

Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 contains an authorization bypass in the session upgrade endpoint, which creates a new session for any valid session token without enforcing the Session class create class-level permission. Attackers holding a user's session token can sen...

CVE-2026-121413

The Parse Server software is affected by an authorization bypass in the session upgrade endpoint, impacting versions prior to 8.6.112 and 9.0.0 before 9.10.6-alpha.4 . The root cause is the failure to enforce the _Session class create class-level permission when creating new sessions for valid se...

EUVD-2026-115945

Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 contains an authorization bypass in the session upgrade endpoint, which creates a new session for any valid session token without enforcing the Session class create class-level permission. Attackers holding a user's session token can sen...

CVE-2026-121413: parse-community parse-server: Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 contains an authorization bypass in the session upgrade…

Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 contains an authorization bypass in the session upgrade endpoint, which creates a new session for any valid session token without enforcing the Session class create class-level permission. Attackers holding a user's session token can sen...

Uncaught Exception

Overview org.webjars.npm:engine.io is a WebJar for engine.io. Affected versions of this package are vulnerable to Uncaught Exception via the session upgrade handler in server.ts, where follow-up requests and transport upgrades do not validate that the Engine.IO protocol revision matches the one...

Uncaught Exception

Overview engine.io is a realtime engine behind Socket.IO. It provides the foundation of a bidirectional connection between client and server Affected versions of this package are vulnerable to Uncaught Exception via the session upgrade handler in server.ts, where follow-up requests and transport...

PT-2023-21166 · Npm · Nextauth.Js

Name of the Vulnerable Software and Affected Versions: NextAuth.js versions prior to v4.20.1 Description: The issue allows a bad actor to intercept and tamper with the authorization URL, enabling them to log in as the victim and bypass CSRF protection. This occurs due to a partial failure during ...

CVE-2021-32099

A SQL injection vulnerability in the pandoraconsole component of Artica Pandora FMS 742 allows an unauthenticated attacker to upgrade his unprivileged session via the /include/chartgenerator.php sessionid parameter, leading to a login bypass...

WordPress: Multiple vulnerabilities

Background WordPress is a PHP and MySQL based content management and publishing system. Description James Bercegay of the GulfTech Security Research Team discovered that WordPress insufficiently checks data passed to the XML-RPC server. He also discovered that WordPress has several cross-site...