Parse Server role escalation and CLP bypass via direct `_Join` table write

Parse Server: Account takeover via operator injection in authentication data identifier

Parse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL

Parse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQL

Parse Server has a SQL injection via dot-notation field name in PostgreSQL

Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters

Parse Server GitHub CI workflow vulnerable to RCE through Improper Privilege Management

Parse Server: Cloud function validator bypass via prototype chain traversal

Parse Server: Auth provider validation bypass on login via partial authData

Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes

Parse Server session token exfiltration via `redirectClassNameForKey` query parameter

Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter

Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB

Parse Server: GraphQL API endpoint ignores CORS origin restriction

Parse Server has an LDAP injection via unsanitized user input in DN and group filter construction

Parse Server OAuth2 authentication adapter account takeover via identity spoofing

Parse Server is missing audience validation in Keycloak authentication adapter

Parse Server: Denial of service via exponential-time processing of deeply nested query operators

Parse Server: Pre-authentication denial of service via client version header regex backtracking

Parse Server before 8.6.97 and 9.10.2-alpha.6 Denial of Service via Unhandled Email Error

Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries

Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection

Parse Server - Arbitrary Code Execution via Malicious Version Tags

Parse Server - Unreviewed Code Execution via Malicious Version Tags

Parse Server: Streaming file download bypasses afterFind file trigger authorization

Parse Server: GraphQL complexity validator exponential fragment traversal DoS

Parse Server: Denial of service via unindexed database query for unconfigured auth providers

Parse Server: LiveQuery subscription query depth bypass

Parse Server: Query condition depth bypass via pre-validation transform pipeline

Parse Server crash via deeply nested query condition operators

Parse Server's Cloud function dispatch crashes server via prototype chain traversal

Parse Server vulnerable to schema poisoning via prototype pollution in deep copy

Parse Server: LiveQuery subscription with invalid regular expression crashes server

Parse Server has a protected fields bypass via LiveQuery subscription WHERE clause

Parse Server has a protected fields bypass via dot-notation in query and sort

Parse Server has a rate limit bypass via batch request endpoint

Parse Server ha a bypass of class-level permissions in LiveQuery

Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API

Parse Server has a NoSQL injection via token type in password reset and email verification endpoints

Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution

Parse Server affected by Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery

Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format

Parse Server crashes when receiving file download request with invalid byte range

Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses

Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password

Parse Server OAuth2 adapter shares mutable state across providers via singleton instance

Parse Server GraphQL WebSocket endpoint bypasses security middleware

Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter

Parse Server: Endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user

Parse Server: Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction