Lucene search
+L

2 matches found

Github Security Blog
Github Security Blog
added 2026/03/10 12:57 a.m.17 views

Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement

Impact The requestKeywordDenylist security control can be bypassed by placing any nested object or array before a prohibited keyword in the request payload. This is caused by a logic bug that stops scanning sibling keys after encountering the first nested value. Any custom requestKeywordDenylist...

6.9CVSS5.9AI score0.00393EPSS
SaveExploits0References5Affected Software1
Rows per page
Query Builder