parse-server vulnerabilities

2 known vulnerabilities in parse-server from Parseplatform. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 10.0 Critical severity

  parse-server: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2024-27298Mar 1, 2024Parse-communityEPSS 1.03%

  parse-server is a Parse Server for Node.js / Express. This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database. The vulnerability has been fixed in 6.5.0 and 7.0.0-alpha.20.

• 8.1 High severity

  parse-server: Authentication Bypass by Spoofing

  CVE-2023-22474Feb 3, 2023Parse-community

  Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server uses the request header `x-forwarded-for` to determine the client IP address. If Parse Server doesn't run behind a proxy server, then a client