GCVE - cpe:2.3:a:parse_community:parse

Approved changes feed: RSS · Atom

cpe:2.3:a:parse_community:parse_server:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Parse Community (`24548432-6b9f-594c-b0e2-90c1e794ee05`)
Product	Parse Server (`8ac74cdb-e6ff-52de-bab8-4907449ff03e`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-47183`	vulnerable	2026-06-08 06:48:11.553142	Parse Server's custom object ID allows to acquire role privileges HIGH (8.1) Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. If the Parse Server option allowCustomObjectId: true is set, an attacker that is allowed to create a new user can set a custom object ID for that new user that exploits the vulnerability and acquires privileges of a specific role. This vulnerability is fixed in 6.5.9 and 7.3.0. Published: 2024-10-04T15:06:45.274Z Updated: 2024-10-04T15:30:37.224Z Open on db.gcve.eu Reference links https://github.com/parse-community/parse-server/security/advisories/GHSA-8xq9-g7ch-35hg https://github.com/parse-community/parse-server/pull/9317 https://github.com/parse-community/parse-server/pull/9318 https://github.com/parse-community/parse-server/commit/13ee52f0d19ef3a3524b3d79aea100e587eb3cfc https://github.com/parse-community/parse-server/commit/1bfbccf9ee7ea77533b2b2aa7c4c69f3bd35e66f	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-39309`	vulnerable	2026-06-08 06:41:49.037809	ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability CRITICAL (9.8) Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A vulnerability in versions prior to 6.5.7 and 7.1.0 allows SQL injection when Parse Server is configured to use the PostgreSQL database. The algorithm to detect SQL injection has been improved in versions 6.5.7 and 7.1.0. No known workarounds are available. Published: 2024-07-01T21:15:26.242Z Updated: 2024-08-02T04:19:20.712Z Open on db.gcve.eu Reference links https://github.com/parse-community/parse-server/security/advisories/GHSA-c2hr-cqg6-8j6r https://github.com/parse-community/parse-server/pull/9167 https://github.com/parse-community/parse-server/pull/9168 https://github.com/parse-community/parse-server/commit/2edf1e4c0363af01e97a7fbc97694f851b7d1ff3 https://github.com/parse-community/parse-server/commit/f332d54577608c5ad927255e06d8c694e2e0ff5b	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-29027`	vulnerable	2026-06-08 06:33:28.423580	Parse Server crash and RCE via invalid Cloud Function or Cloud Job name CRITICAL (9.1) Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 6.5.5 and 7.0.0-alpha.29, calling an invalid Parse Server Cloud Function name or Cloud Job name crashes the server and may allow for code injection, internal store manipulation or remote code execution. The patch in versions 6.5.5 and 7.0.0-alpha.29 added string sanitation for Cloud Function name and Cloud Job name. As a workaround, sanitize the Cloud Function name and Cloud Job name before it reaches Parse Server. Published: 2024-03-19T18:57:24.782Z Updated: 2024-08-02T14:42:21.433Z Open on db.gcve.eu Reference links https://github.com/parse-community/parse-server/security/advisories/GHSA-6hh7-46r2-vf29 https://github.com/parse-community/parse-server/commit/5ae6d6a36d75c4511029f0ba5673ae4b2999179b https://github.com/parse-community/parse-server/commit/9f6e3429d3b326cf4e2994733c618d08032fac6e https://github.com/parse-community/parse-server/releases/tag/6.5.5 https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.29	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-46119`	vulnerable	2026-06-08 06:12:43.877628	Parse Server may crash when uploading file without extension HIGH (7.5) Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server crashes when uploading a file without extension. This vulnerability has been patched in versions 5.5.6 and 6.3.1. Published: 2023-10-25T00:03:55.774Z Updated: 2024-09-10T15:56:13.252Z Open on db.gcve.eu Reference links https://github.com/parse-community/parse-server/security/advisories/GHSA-792q-q67h-w579 https://github.com/parse-community/parse-server/commit/686a9f282dc23c31beab3d93e6d21ccd0e1328fe https://github.com/parse-community/parse-server/commit/fd86278919556d3682e7e2c856dfccd5beffbfc0 https://github.com/parse-community/parse-server/releases/tag/5.5.6 https://github.com/parse-community/parse-server/releases/tag/6.3.1	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Parse Server

Notes

PURL mappings

Vulnerability references

Contribute