parse-server vulnerabilities (npm)
118 vulnerabilities.
parse-servernpmParse Server MFA recovery codes not consumed after use8.2 Highparse-servernpmParse Server has a protected fields bypass via dot-notation in query and sort8.7 Highparse-servernpmParse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL9.3 Criticalparse-servernpmParse Server has Stored XSS via file upload of HTML-renderable file types6.3 Mediumparse-servernpmParse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQL9.3 Criticalparse-servernpmParse Server has an LDAP injection via unsanitized user input in DN and group filter construction6.0 Mediumparse-servernpmParse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes8.8 Highparse-servernpmParse Server has a rate limit bypass via batch request endpoint6.9 Mediumparse-servernpmParse Server OAuth2 authentication adapter account takeover via identity spoofing7.6 Highparse-servernpmParse Server role escalation and CLP bypass via direct `_Join` table write10.0 Criticalparse-servernpmParse Server session token exfiltration via `redirectClassNameForKey` query parameter9.9 Criticalparse-servernpmParse Server has a protected fields bypass via logical query operators7.1 Highparse-servernpmParse Server is missing audience validation in Keycloak authentication adapter7.6 Highparse-servernpmParse Server has stored cross-site scripting (XSS) via SVG file upload8.3 Highparse-servernpmParse Server ha a bypass of class-level permissions in LiveQuery8.7 Highparse-servernpmParse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API8.7 Highparse-servernpmParse Server has a SQL injection via dot-notation field name in PostgreSQL9.3 Criticalparse-servernpmParse Server has a NoSQL injection via token type in password reset and email verification endpoints8.7 Highparse-servernpmParse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution8.8 Highparse-servernpmParse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement6.9 Mediumparse-servernpmParse Server affected by Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery8.2 Highparse-servernpmParse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled6.9 Mediumparse-servernpmParse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization6.3 Mediumparse-servernpmParse Server: `PagesRouter` path traversal allows reading files outside configured pages directory6.3 Mediumparse-servernpmParse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters9.3 Criticalparse-servernpmParse Server: Malformed `$regex` query leaks database error details in API response6.9 Mediumparse-servernpmParse Server: Endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user8.5 Highparse-servernpmParse Server: File creation and deletion bypasses `readOnlyMasterKey` write restriction6.9 Mediumparse-servernpmParse Server: Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction8.6 Highparse-servernpmParse Server: Account takeover via JWT algorithm confusion in Google auth adapter9.3 Criticalparse-servernpmParse Server has Server-Side Request Forgery (SSRF) in Instagram OAuth Adapter8.3 Highparse-servernpmParse Server vulnerable to Cross-Site Scripting (XSS) via Unescaped Mustache Template Variables5.3 Mediumparse-servernpmParse Server allows public `explain` queries which may expose sensitive database performance information and schema details6.9 Mediumparse-servernpmParse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format7.5 Highparse-servernpmParse Server exposes the data schema via GraphQL API5.3 Mediumparse-servernpmParse Server has an OAuth login vulnerability6.9 Mediumparse-servernpmParse Server's custom object ID allows to acquire role privileges8.1 Highparse-servernpmZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability9.8 Criticalparse-servernpmParse Server crash and RCE via invalid Cloud Function or Cloud Job name9.1 Criticalparse-servernpmParse Server literalizeRegexPart SQL Injection10.0 Criticalparse-servernpmParse Server may crash when uploading file without extension7.5 Highparse-servernpmTrigger `beforeFind` not invoked in internal query pipeline in parse-server7.5 Highparse-servernpmParse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution9.8 Criticalparse-servernpmParse Server vulnerable to phishing attack vulnerability that involves uploading malicious HTML file6.3 Mediumparse-servernpmParse Server is vulnerable to authentication bypass via spoofing8.7 Highparse-servernpmParse Server subject to Prototype pollution via Cloud Code Webhooks7.2 Highparse-servernpmParse Server Prototype pollution and Injection via Cloud Code Webhooks or Cloud Code Triggers7.2 Highparse-servernpmParse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser9.8 Criticalparse-servernpmParse Server crashes when receiving file download request with invalid byte range7.5 Highparse-servernpmParse Server subject to Improper Authentication allowing Auth adapter app ID validation to be circumvented3.7 Low- Show moreLoading…