Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

VulnScan

parse-server Security Vulnerabilities | CyStack CVE Database

CVE	Exploitation status	Fix	Published	Severity
`CVE-2026-87806`Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password	Exploitation statusNot known exploited	FixYes	Published09/09/2026	SeverityCritical
`CVE-2026-66009`Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages	Exploitation statusNot known exploited	FixYes	Published07/24/2026	SeverityMedium
`CVE-2026-66008`Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages	Exploitation statusNot known exploited	FixYes	Published07/24/2026	SeverityMedium
`CVE-2026-64627`Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion	Exploitation statusNot known exploited	FixYes	Published07/21/2026	SeverityMedium
`CVE-2026-61448`Parse Server 9.0.0 Stored XSS via malformed Content-Type	Exploitation statusNot known exploited	FixYes	Published07/11/2026	SeverityLow
`CVE-2026-57481`Parse Server: LiveQuery discloses object data to a subscriber across an ACL read-access change	Exploitation statusNot known exploited	FixYes	Published07/08/2026	SeverityLow
`CVE-2026-57480`Parse Server: Denial of service via exponential-time processing of deeply nested query operators	Exploitation statusNot known exploited	FixYes	Published07/08/2026	SeverityHigh
`CVE-2026-55778`Parse Server: Stored XSS via non-standard file extension bypassing file upload extension blocklist	Exploitation statusNot known exploited	FixYes	Published07/08/2026	SeverityLow
`CVE-2021-47987`Parse Server - Arbitrary Code Execution via Malicious Version Tags	Exploitation statusNot known exploited	FixYes	Published06/25/2026	SeverityHigh
`CVE-2021-47986`Parse Server - Unreviewed Code Execution via Malicious Version Tags	Exploitation statusNot known exploited	FixYes	Published06/25/2026	SeverityHigh
`CVE-2026-53726`Parse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL	Exploitation statusNot known exploited	FixYes	Published06/12/2026	SeverityMedium
`CVE-2026-53725`Parse Server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied	Exploitation statusNot known exploited	FixYes	Published06/12/2026	SeverityMedium
`CVE-2026-53724`Parse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist	Exploitation statusNot known exploited	FixYes	Published06/12/2026	SeverityLow
`CVE-2026-50008`Parse Server: Server option routeAllowList is bypassable through batch sub-requests	Exploitation statusNot known exploited	FixYes	Published06/12/2026	SeverityMedium
`CVE-2026-47138`Parse Server: Pre-authentication denial of service via client version header regex backtracking	Exploitation statusNot known exploited	FixYes	Published06/12/2026	SeverityHigh
`CVE-2026-47248`Parse Server: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers	Exploitation statusNot known exploited	FixYes	Published06/12/2026	SeverityMedium
`CVE-2026-43930`Parse Server: MFA SMS one-time password accepted twice under concurrent login	Exploitation statusNot known exploited	FixYes	Published05/12/2026	SeverityLow
`CVE-2026-39381`Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`	Exploitation statusNot known exploited	FixYes	Published04/07/2026	SeverityMedium
`CVE-2026-39321`Parse Server has a login timing side-channel reveals user existence	Exploitation statusNot known exploited	FixYes	Published04/07/2026	SeverityMedium
`CVE-2026-35200`Parse Server has a file upload Content-Type override via extension mismatch	Exploitation statusNot known exploited	FixYes	Published04/06/2026	SeverityLow
`CVE-2026-34784`Parse Server: Streaming file download bypasses afterFind file trigger authorization	Exploitation statusNot known exploited	FixYes	Published03/31/2026	SeverityHigh
`CVE-2026-34215`Parse Server: Auth data exposed via verify password endpoint	Exploitation statusNot known exploited	FixYes	Published03/31/2026	SeverityHigh
`CVE-2026-34595`Parse Server: LiveQuery protected-field guard bypass via array-like logical operator value	Exploitation statusNot known exploited	FixYes	Published03/31/2026	SeverityMedium
`CVE-2026-34574`Parse Server: Session field immutability bypass via falsy-value guard	Exploitation statusNot known exploited	FixYes	Published03/31/2026	SeverityMedium
`CVE-2026-34573`Parse Server: GraphQL complexity validator exponential fragment traversal DoS	Exploitation statusNot known exploited	FixYes	Published03/31/2026	SeverityHigh
`CVE-2026-34532`Parse Server: Cloud function validator bypass via prototype chain traversal	Exploitation statusNot known exploited	FixYes	Published03/31/2026	SeverityCritical
`CVE-2026-34373`Parse Server: GraphQL API endpoint ignores CORS origin restriction	Exploitation statusNot known exploited	FixYes	Published03/31/2026	SeverityMedium
`CVE-2026-34363`Parse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribers	Exploitation statusNot known exploited	FixYes	Published03/31/2026	SeverityHigh
`CVE-2026-34224`Parse Server: MFA single-use token bypass via concurrent authData login requests	Exploitation statusNot known exploited	FixYes	Published03/31/2026	SeverityLow
`CVE-2026-33627`Parse Server: Auth data exposed via /users/me endpoint	Exploitation statusNot known exploited	FixYes	Published03/24/2026	SeverityHigh
`CVE-2026-33624`Parse Server: MFA recovery code single-use bypass via concurrent requests	Exploitation statusNot known exploited	FixYes	Published03/24/2026	SeverityLow
`CVE-2026-33539`Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter	Exploitation statusNot known exploited	FixYes	Published03/24/2026	SeverityHigh
`CVE-2026-33538`Parse Server: Denial of service via unindexed database query for unconfigured auth providers	Exploitation statusNot known exploited	FixYes	Published03/24/2026	SeverityHigh
`CVE-2026-33527`Parse Server: Session update endpoint allows overwriting server-generated session fields	Exploitation statusNot known exploited	FixYes	Published03/24/2026	SeverityMedium
`CVE-2026-33508`Parse Server: LiveQuery subscription query depth bypass	Exploitation statusNot known exploited	FixYes	Published03/24/2026	SeverityHigh
`CVE-2026-33498`Parse Server: Query condition depth bypass via pre-validation transform pipeline	Exploitation statusNot known exploited	FixYes	Published03/24/2026	SeverityHigh
`CVE-2026-33429`Parse Server: Protected field change detection oracle via LiveQuery watch parameter	Exploitation statusNot known exploited	FixYes	Published03/24/2026	SeverityMedium
`CVE-2026-33421`Parse Server: LiveQuery bypasses CLP pointer permission enforcement	Exploitation statusNot known exploited	FixYes	Published03/24/2026	SeverityHigh
`CVE-2026-33409`Parse Server: Auth provider validation bypass on login via partial authData	Exploitation statusNot known exploited	FixYes	Published03/24/2026	SeverityHigh
`CVE-2026-33323`Parse Server: Email verification resend page leaks user existence	Exploitation statusNot known exploited	FixYes	Published03/24/2026	SeverityMedium
`CVE-2026-33163`Parse Server leaks protected fields via LiveQuery afterEvent trigger	Exploitation statusNot known exploited	FixNot confirmed	Published03/18/2026	SeverityHigh
`CVE-2026-33042`Parse Server affected by empty authData bypassing credential requirement on signup	Exploitation statusNot known exploited	FixNot confirmed	Published03/18/2026	SeverityMedium
`CVE-2026-32944`Parse Server crash via deeply nested query condition operators	Exploitation statusNot known exploited	FixNot confirmed	Published03/18/2026	SeverityHigh
`CVE-2026-32943`Parse Server has a password reset token single-use bypass via concurrent requests	Exploitation statusNot known exploited	FixNot confirmed	Published03/18/2026	SeverityLow
`CVE-2026-32886`Parse Server's Cloud function dispatch crashes server via prototype chain traversal	Exploitation statusNot known exploited	FixNot confirmed	Published03/18/2026	SeverityHigh
`CVE-2026-32878`Parse Server vulnerable to schema poisoning via prototype pollution in deep copy	Exploitation statusNot known exploited	FixNot confirmed	Published03/18/2026	SeverityMedium
`CVE-2026-32770`Parse Server: LiveQuery subscription with invalid regular expression crashes server	Exploitation statusNot known exploited	FixNot confirmed	Published03/18/2026	SeverityMedium
`CVE-2026-32742`Parse Server session creation endpoint allows overwriting server-generated session fields	Exploitation statusNot known exploited	FixNot confirmed	Published03/18/2026	SeverityMedium
`CVE-2026-32728`Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries	Exploitation statusNot known exploited	FixNot confirmed	Published03/18/2026	SeverityHigh
`CVE-2026-32594`Parse Server GraphQL WebSocket endpoint bypasses security middleware	Exploitation statusNot known exploited	FixYes	Published03/13/2026	SeverityMedium
`CVE-2026-32269`Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint	Exploitation statusNot known exploited	FixYes	Published03/12/2026	SeverityMedium
`CVE-2026-32248`Parse Server: Account takeover via operator injection in authentication data identifier	Exploitation statusNot known exploited	FixYes	Published03/12/2026	SeverityCritical
`CVE-2026-32242`Parse Server OAuth2 adapter shares mutable state across providers via singleton instance	Exploitation statusNot known exploited	FixYes	Published03/12/2026	SeverityCritical
`CVE-2026-32234`Parse Server has a SQL injection via query field name when using PostgreSQL	Exploitation statusNot known exploited	FixYes	Published03/11/2026	SeverityMedium
`CVE-2026-32098`Parse Server has a protected fields bypass via LiveQuery subscription WHERE clause	Exploitation statusNot known exploited	FixYes	Published03/11/2026	SeverityMedium
`CVE-2026-31901`Parse Server has user enumeration via email verification endpoint	Exploitation statusNot known exploited	FixYes	Published03/11/2026	SeverityMedium
`CVE-2026-31875`Parse Server MFA recovery codes not consumed after use	Exploitation statusNot known exploited	FixYes	Published03/11/2026	SeverityHigh
`CVE-2026-31872`Parse Server has a protected fields bypass via dot-notation in query and sort	Exploitation statusNot known exploited	FixYes	Published03/11/2026	SeverityHigh
`CVE-2026-31871`Parse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL	Exploitation statusNot known exploited	FixYes	Published03/11/2026	SeverityCritical
`CVE-2026-31868`Parse Server has Stored XSS via file upload of HTML-renderable file types	Exploitation statusNot known exploited	FixYes	Published03/11/2026	SeverityMedium
`CVE-2026-31856`Parse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQL	Exploitation statusNot known exploited	FixYes	Published03/11/2026	SeverityCritical
`CVE-2026-31840`Parse Server has a SQL injection via dot-notation field name in PostgreSQL	Exploitation statusNot known exploited	FixYes	Published03/11/2026	SeverityCritical
`CVE-2026-31828`Parse Server has an LDAP injection via unsanitized user input in DN and group filter construction	Exploitation statusNot known exploited	FixYes	Published03/10/2026	SeverityMedium
`CVE-2026-31800`Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes	Exploitation statusNot known exploited	FixYes	Published03/10/2026	SeverityHigh
`CVE-2026-30972`Parse Server has a rate limit bypass via batch request endpoint	Exploitation statusNot known exploited	FixYes	Published03/10/2026	SeverityMedium
`CVE-2026-30967`Parse Server OAuth2 authentication adapter account takeover via identity spoofing	Exploitation statusNot known exploited	FixYes	Published03/10/2026	SeverityHigh
`CVE-2026-30966`Parse Server role escalation and CLP bypass via direct `_Join` table write	Exploitation statusNot known exploited	FixYes	Published03/10/2026	SeverityCritical
`CVE-2026-30965`Parse Server session token exfiltration via `redirectClassNameForKey` query parameter	Exploitation statusNot known exploited	FixYes	Published03/10/2026	SeverityCritical
`CVE-2026-30962`Parse Server has a protected fields bypass via logical query operators	Exploitation statusNot known exploited	FixYes	Published03/10/2026	SeverityHigh
`CVE-2026-30949`Parse Server is missing audience validation in Keycloak authentication adapter	Exploitation statusNot known exploited	FixYes	Published03/10/2026	SeverityHigh
`CVE-2026-30948`Parse Server has stored cross-site scripting (XSS) via SVG file upload	Exploitation statusNot known exploited	FixYes	Published03/10/2026	SeverityHigh
`CVE-2026-30947`Parse Server ha a bypass of class-level permissions in LiveQuery	Exploitation statusNot known exploited	FixYes	Published03/10/2026	SeverityHigh
`CVE-2026-30946`Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API	Exploitation statusNot known exploited	FixYes	Published03/10/2026	SeverityHigh
`CVE-2026-30941`Parse Server has a NoSQL injection via token type in password reset and email verification endpoints	Exploitation statusNot known exploited	FixYes	Published03/10/2026	SeverityHigh
`CVE-2026-30939`Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution	Exploitation statusNot known exploited	FixYes	Published03/10/2026	SeverityHigh
`CVE-2026-30938`Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement	Exploitation statusNot known exploited	FixYes	Published03/10/2026	SeverityMedium
`CVE-2026-30925`Parse Server affected by Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery	Exploitation statusNot known exploited	FixYes	Published03/09/2026	SeverityHigh
`CVE-2026-30854`Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled	Exploitation statusNot known exploited	FixYes	Published03/07/2026	SeverityMedium
`CVE-2026-30850`Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization	Exploitation statusNot known exploited	FixYes	Published03/07/2026	SeverityMedium
`CVE-2026-30848`Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directory	Exploitation statusNot known exploited	FixYes	Published03/07/2026	SeverityMedium
`CVE-2026-30863`Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters	Exploitation statusNot known exploited	FixYes	Published03/07/2026	SeverityCritical
`CVE-2026-30835`Parse Server: Malformed `$regex` query leaks database error details in API response	Exploitation statusNot known exploited	FixYes	Published03/06/2026	SeverityMedium
`CVE-2026-30229`Parse Server: Endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user	Exploitation statusNot known exploited	FixYes	Published03/06/2026	SeverityHigh
`CVE-2026-30228`Parse Server: File creation and deletion bypasses `readOnlyMasterKey` write restriction	Exploitation statusNot known exploited	FixYes	Published03/06/2026	SeverityMedium
`CVE-2026-29182`Parse Server: Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction	Exploitation statusNot known exploited	FixYes	Published03/06/2026	SeverityHigh
`CVE-2026-27804`Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter	Exploitation statusNot known exploited	FixNot confirmed	Published02/25/2026	SeverityCritical
`CVE-2025-68150`Parse Server has Server-Side Request Forgery (SSRF) in Instagram OAuth Adapter	Exploitation statusNot known exploited	FixYes	Published12/16/2025	SeverityHigh
`CVE-2025-68115`Parse Server vulnerable to Cross-Site Scripting (XSS) via Unescaped Mustache Template Variables	Exploitation statusNot known exploited	FixNot confirmed	Published12/16/2025	SeverityMedium
`CVE-2025-67727`Parse Server GitHub CI workflow vulnerable to RCE through Improper Privilege Management	Exploitation statusNot known exploited	FixNot confirmed	Published12/12/2025	SeverityMedium
`CVE-2025-64502`Parse Server allows public `explain` queries which may expose sensitive database performance information and schema details	Exploitation statusNot known exploited	FixNot confirmed	Published11/10/2025	SeverityMedium
`CVE-2025-64430`Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format	Exploitation statusNot known exploited	FixYes	Published11/07/2025	SeverityHigh
`CVE-2025-53364`Parse Server exposes the data schema via GraphQL API	Exploitation statusNot known exploited	FixYes	Published07/10/2025	SeverityMedium
`CVE-2025-30168`Parse Server has an OAuth login vulnerability	Exploitation statusNot known exploited	FixYes	Published03/21/2025	SeverityMedium
`CVE-2024-47183`Parse Server's custom object ID allows to acquire role privileges	Exploitation statusPublic exploit	FixYes	Published10/04/2024	SeverityHigh
`CVE-2024-39309`ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability	Exploitation statusNot known exploited	FixNot confirmed	Published07/01/2024	SeverityCritical
`CVE-2024-29027`Parse Server crash and RCE via invalid Cloud Function or Cloud Job name	Exploitation statusNot known exploited	FixNot confirmed	Published03/19/2024	SeverityCritical
`CVE-2024-27298`Parse Server literalizeRegexPart SQL Injection	Exploitation statusPublic exploit	FixYes	Published03/01/2024	SeverityCritical
`CVE-2023-46119`Parse Server may crash when uploading file without extension	Exploitation statusNot known exploited	FixYes	Published10/25/2023	SeverityHigh
`CVE-2023-41058`Trigger `beforeFind` not invoked in internal query pipeline in parse-server	Exploitation statusNot known exploited	FixYes	Published09/04/2023	SeverityHigh
`CVE-2023-36475`Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution	Exploitation statusNot known exploited	FixYes	Published06/28/2023	SeverityCritical

100 / 121 Results

Security vulnerabilities in parse-server

parse-server

Verify to analyze this security profile

How many security vulnerabilities does parse-server have?

Does the latest parse-server version have known vulnerabilities?

Run an in-depth assessment with complete web risk management