parseplatform kayıtları
parseplatform üreticisine ait 109 yayımlanmış kayıt.
Araştırmacı profili
- KEV’e giren
- 0 · %0
- Silahlaştırılmış
- 0 · %0
- Pre-auth RCE
- 5
- Düzeltme kaydı olan
- %99,1
- Yayından KEV’e ortanca
- KEV’e giren kayıt yok
Tekrar eden sınıflar
- CWE-863 Incorrect Authorization11
- CWE-287 Improper Authentication9
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor7
- CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')7
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')6
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')4
Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.
CWETüm kayıtlar
109 kayıt| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
55Planlayın | CVE-2022-24760Kavram kanıtı | Command Injection in Parse serverparseplatform · parse-server · CWE-74 | Kritik10,0 | — | %49,1 | 11 Mar 2022 |
51Planlayın | CVE-2022-39396İstismar yok | Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parserparseplatform · parse-server · CWE-1321 | Kritik9,8 | — | %38,7 | 9 Kas 2022 |
40Planlayın | CVE-2023-36475İstismar yok | Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollutionparseplatform · parse-server · CWE-1321 | Kritik9,8 | — | %3,2 | 28 Haz 2023 |
40Planlayın | CVE-2024-27298İstismar yok | Parse Server literalizeRegexPart SQL Injectionparseplatform · parse-server · CWE-89 | Kritik10,0 | — | %1,0 | 1 Mar 2024 |
40Planlayın | CVE-2026-30966İstismar yok | Parse Server role escalation and CLP bypass via direct `_Join` table writeparseplatform · parse-server · CWE-284 | Kritik10,0 | — | %0,5 | 10 Mar 2026 |
39İzleyin | CVE-2026-30965Kavram kanıtı | Parse Server session token exfiltration via `redirectClassNameForKey` query parameterparseplatform · parse-server · CWE-863 | Kritik9,9 | — | %1,6 | 10 Mar 2026 |
39İzleyin | CVE-2022-41878İstismar yok | Parse Server Prototype pollution and Injection via Cloud Code Webhooks or Cloud Code Triggersparseplatform · parse-server · CWE-74 | Kritik9,8 | — | %0,9 | 10 Kas 2022 |
39İzleyin | CVE-2022-41879İstismar yok | Parse Server subject to Prototype pollution via Cloud Code Webhooksparseplatform · parse-server · CWE-1321 | Kritik9,8 | — | %0,9 | 10 Kas 2022 |
39İzleyin | CVE-2026-27595İstismar yok | Parse Dashboard has incomplete authentication on AI Agent endpointparseplatform · parse dashboard · CWE-306 | Kritik9,9 | — | %0,6 | 24 Şub 2026 |
37İzleyin | CVE-2026-32248İstismar yok | Parse Server: Account takeover via operator injection in authentication data identifierparseplatform · parse-server · CWE-943 | Kritik9,3 | — | %0,9 | 12 Mar 2026 |
37İzleyin | CVE-2026-31840İstismar yok | Parse Server has a SQL injection via dot-notation field name in PostgreSQLparseplatform · parse-server · CWE-89 | Kritik9,3 | — | %0,7 | 11 Mar 2026 |
37İzleyin | CVE-2026-30863Kavram kanıtı | Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adaptersparseplatform · parse-server · CWE-287 | Kritik9,3 | — | %0,7 | 7 Mar 2026 |
37İzleyin | CVE-2026-31856İstismar yok | Parse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQLparseplatform · parse-server · CWE-89 | Kritik9,3 | — | %0,5 | 11 Mar 2026 |
37İzleyin | CVE-2026-31871İstismar yok | Parse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQLparseplatform · parse-server · CWE-89 | Kritik9,3 | — | %0,5 | 11 Mar 2026 |
37İzleyin | CVE-2026-27608İstismar yok | Parse Dashboard Missing Authorization on Agent Endpointparseplatform · parse dashboard · CWE-862 | Kritik9,3 | — | %0,4 | 24 Şub 2026 |
37İzleyin | CVE-2026-27804İstismar yok | Parse Server: Account takeover via JWT algorithm confusion in Google auth adapterparseplatform · parse-server · CWE-327 | Kritik9,3 | — | %0,2 | 25 Şub 2026 |
36İzleyin | CVE-2024-29027İstismar yok | Parse Server crash and RCE via invalid Cloud Function or Cloud Job nameparseplatform · parse-server · CWE-74 | Kritik9,0 | — | %1,2 | 19 Mar 2024 |
36İzleyin | CVE-2026-34532İstismar yok | Parse Server: Cloud function validator bypass via prototype chain traversalparseplatform · parse-server · CWE-863 | Kritik9,1 | — | %0,5 | 31 Mar 2026 |
36İzleyin | CVE-2026-32242İstismar yok | Parse Server OAuth2 adapter shares mutable state across providers via singleton instanceparseplatform · parse-server · CWE-362 | Kritik9,1 | — | %0,4 | 12 Mar 2026 |
35İzleyin | CVE-2026-30939İstismar yok | Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolutionparseplatform · parse-server · CWE-1321 | Yüksek8,8 | — | %0,7 | 10 Mar 2026 |
35İzleyin | CVE-2026-31800İstismar yok | Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routesparseplatform · parse-server · CWE-862 | Yüksek8,8 | — | %0,6 | 10 Mar 2026 |
34İzleyin | CVE-2026-33538İstismar yok | Parse Server: Denial of service via unindexed database query for unconfigured auth providersparseplatform · parse-server · CWE-400 | Yüksek8,7 | — | %0,8 | 24 Mar 2026 |
34İzleyin | CVE-2026-33539İstismar yok | Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapterparseplatform · parse-server · CWE-89 | Yüksek8,6 | — | %0,7 | 24 Mar 2026 |
34İzleyin | CVE-2026-30946İstismar yok | Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL APIparseplatform · parse-server · CWE-770 | Yüksek8,7 | — | %0,6 | 10 Mar 2026 |
34İzleyin | CVE-2026-33498İstismar yok | Parse Server: Query condition depth bypass via pre-validation transform pipelineparseplatform · parse-server · CWE-674 | Yüksek8,7 | — | %0,6 | 24 Mar 2026 |
- CVE-2022-2476055Planlayın
Command Injection in Parse server
KritikCVSS 10,0Kavram kanıtıEPSS %49parseplatform · parse-server11 Mar 2022
- CVE-2022-3939651Planlayın
Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser
KritikCVSS 9,8İstismar yokEPSS %39parseplatform · parse-server9 Kas 2022
- CVE-2023-3647540Planlayın
Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution
KritikCVSS 9,8İstismar yokEPSS %3parseplatform · parse-server28 Haz 2023
- CVE-2024-2729840Planlayın
Parse Server literalizeRegexPart SQL Injection
KritikCVSS 10,0İstismar yokEPSS %1parseplatform · parse-server1 Mar 2024
- CVE-2026-3096640Planlayın
Parse Server role escalation and CLP bypass via direct `_Join` table write
KritikCVSS 10,0İstismar yokEPSS %1parseplatform · parse-server10 Mar 2026
- CVE-2026-3096539İzleyin
Parse Server session token exfiltration via `redirectClassNameForKey` query parameter
KritikCVSS 9,9Kavram kanıtıEPSS %2parseplatform · parse-server10 Mar 2026
- CVE-2022-4187839İzleyin
Parse Server Prototype pollution and Injection via Cloud Code Webhooks or Cloud Code Triggers
KritikCVSS 9,8İstismar yokEPSS %1parseplatform · parse-server10 Kas 2022
- CVE-2022-4187939İzleyin
Parse Server subject to Prototype pollution via Cloud Code Webhooks
KritikCVSS 9,8İstismar yokEPSS %1parseplatform · parse-server10 Kas 2022
- CVE-2026-2759539İzleyin
Parse Dashboard has incomplete authentication on AI Agent endpoint
KritikCVSS 9,9İstismar yokEPSS %1parseplatform · parse dashboard24 Şub 2026
- CVE-2026-3224837İzleyin
Parse Server: Account takeover via operator injection in authentication data identifier
KritikCVSS 9,3İstismar yokEPSS %1parseplatform · parse-server12 Mar 2026
- CVE-2026-3184037İzleyin
Parse Server has a SQL injection via dot-notation field name in PostgreSQL
KritikCVSS 9,3İstismar yokEPSS %1parseplatform · parse-server11 Mar 2026
- CVE-2026-3086337İzleyin
Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters
KritikCVSS 9,3Kavram kanıtıEPSS %1parseplatform · parse-server7 Mar 2026
- CVE-2026-3185637İzleyin
Parse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQL
KritikCVSS 9,3İstismar yokEPSS %1parseplatform · parse-server11 Mar 2026
- CVE-2026-3187137İzleyin
Parse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL
KritikCVSS 9,3İstismar yokEPSS %1parseplatform · parse-server11 Mar 2026
- CVE-2026-2760837İzleyin
Parse Dashboard Missing Authorization on Agent Endpoint
KritikCVSS 9,3İstismar yokEPSS %0parseplatform · parse dashboard24 Şub 2026
- CVE-2026-2780437İzleyin
Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter
KritikCVSS 9,3İstismar yokEPSS %0parseplatform · parse-server25 Şub 2026
- CVE-2024-2902736İzleyin
Parse Server crash and RCE via invalid Cloud Function or Cloud Job name
KritikCVSS 9,0İstismar yokEPSS %1parseplatform · parse-server19 Mar 2024
- CVE-2026-3453236İzleyin
Parse Server: Cloud function validator bypass via prototype chain traversal
KritikCVSS 9,1İstismar yokEPSS %0parseplatform · parse-server31 Mar 2026
- CVE-2026-3224236İzleyin
Parse Server OAuth2 adapter shares mutable state across providers via singleton instance
KritikCVSS 9,1İstismar yokEPSS %0parseplatform · parse-server12 Mar 2026
- CVE-2026-3093935İzleyin
Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution
YüksekCVSS 8,8İstismar yokEPSS %1parseplatform · parse-server10 Mar 2026
- CVE-2026-3180035İzleyin
Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes
YüksekCVSS 8,8İstismar yokEPSS %1parseplatform · parse-server10 Mar 2026
- CVE-2026-3353834İzleyin
Parse Server: Denial of service via unindexed database query for unconfigured auth providers
YüksekCVSS 8,7İstismar yokEPSS %1parseplatform · parse-server24 Mar 2026
- CVE-2026-3353934İzleyin
Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter
YüksekCVSS 8,6İstismar yokEPSS %1parseplatform · parse-server24 Mar 2026
- CVE-2026-3094634İzleyin
Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API
YüksekCVSS 8,7İstismar yokEPSS %1parseplatform · parse-server10 Mar 2026
- CVE-2026-3349834İzleyin
Parse Server: Query condition depth bypass via pre-validation transform pipeline
YüksekCVSS 8,7İstismar yokEPSS %1parseplatform · parse-server24 Mar 2026