Parse Server role escalation and CLP bypass via direct `_Join` table write

Parse Server literalizeRegexPart SQL Injection

Command Injection in Parse server

Parse Server: Account takeover via operator injection in authentication data identifier

Parse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL

Parse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQL

Parse Server has a SQL injection via dot-notation field name in PostgreSQL

Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters

Parse Server GitHub CI workflow vulnerable to RCE through Improper Privilege Management

Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution

Parse Server Prototype pollution and Injection via Cloud Code Webhooks or Cloud Code Triggers

Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser

Parse Server subject to Prototype pollution via Cloud Code Webhooks

Parse Server: Cloud function validator bypass via prototype chain traversal

Parse Server: Auth provider validation bypass on login via partial authData

Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes

Parse Server session token exfiltration via `redirectClassNameForKey` query parameter

Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter

Parse Server crash and RCE via invalid Cloud Function or Cloud Job name

Parse Server: GraphQL API endpoint ignores CORS origin restriction

Parse Server has an LDAP injection via unsanitized user input in DN and group filter construction

Parse Server OAuth2 authentication adapter account takeover via identity spoofing

Parse Server is missing audience validation in Keycloak authentication adapter

Protected fields exposed via LiveQuery in parse-server

Parse Server's custom object ID allows to acquire role privileges

Parse Server is vulnerable to authentication bypass via spoofing

Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries

Parse Server - Unreviewed Code Execution via Malicious Version Tags

Parse Server: Streaming file download bypasses afterFind file trigger authorization

Parse Server: GraphQL complexity validator exponential fragment traversal DoS

Parse Server: Denial of service via unindexed database query for unconfigured auth providers

Parse Server: LiveQuery subscription query depth bypass

Parse Server: Query condition depth bypass via pre-validation transform pipeline

Parse Server crash via deeply nested query condition operators

Parse Server's Cloud function dispatch crashes server via prototype chain traversal

Parse Server vulnerable to schema poisoning via prototype pollution in deep copy

Parse Server: LiveQuery subscription with invalid regular expression crashes server

Parse Server has a protected fields bypass via LiveQuery subscription WHERE clause

Parse Server has a protected fields bypass via dot-notation in query and sort

Parse Server has a rate limit bypass via batch request endpoint

Parse Server ha a bypass of class-level permissions in LiveQuery

Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API

Parse Server has a NoSQL injection via token type in password reset and email verification endpoints

Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution

Parse Server affected by Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery

Parse Server may crash when uploading file without extension

Trigger `beforeFind` not invoked in internal query pipeline in parse-server

Parse Server crashes when receiving file download request with invalid byte range

Parse Server vulnerable to brute force guessing of user sensitive data via search patterns

Invalid file request can crashe parse-server