Parse Server: GraphQL API endpoint ignores CORS origin restriction

Parse Server has an LDAP injection via unsanitized user input in DN and group filter construction

Parse Server OAuth2 authentication adapter account takeover via identity spoofing

Parse Server is missing audience validation in Keycloak authentication adapter

Protected fields exposed via LiveQuery in parse-server

Parse Server's custom object ID allows to acquire role privileges

Parse Server is vulnerable to authentication bypass via spoofing

Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries

Parse Server - Unreviewed Code Execution via Malicious Version Tags

Parse Server: Streaming file download bypasses afterFind file trigger authorization

Parse Server: GraphQL complexity validator exponential fragment traversal DoS

Parse Server: Denial of service via unindexed database query for unconfigured auth providers

Parse Server: LiveQuery subscription query depth bypass

Parse Server: Query condition depth bypass via pre-validation transform pipeline

Parse Server crash via deeply nested query condition operators

Parse Server's Cloud function dispatch crashes server via prototype chain traversal

Parse Server vulnerable to schema poisoning via prototype pollution in deep copy

Parse Server: LiveQuery subscription with invalid regular expression crashes server

Parse Server has a protected fields bypass via LiveQuery subscription WHERE clause

Parse Server has a protected fields bypass via dot-notation in query and sort

Parse Server has a rate limit bypass via batch request endpoint

Parse Server ha a bypass of class-level permissions in LiveQuery

Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API

Parse Server has a NoSQL injection via token type in password reset and email verification endpoints

Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution

Parse Server affected by Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery

Parse Server may crash when uploading file without extension

Trigger `beforeFind` not invoked in internal query pipeline in parse-server

Parse Server crashes when receiving file download request with invalid byte range

Parse Server vulnerable to brute force guessing of user sensitive data via search patterns

Invalid file request can crashe parse-server

Authentication bypass in Parse Server Apple Game Center auth adapter

Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter

LiveQuery publishes user session tokens

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js

parse-server before 3.4.1 allows DoS after any POST to a volatile class

Parse Server OAuth2 adapter shares mutable state across providers via singleton instance

Parse Server GraphQL WebSocket endpoint bypasses security middleware

Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter

Parse Server: Endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user

Parse Server: Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction