CVE Feed

    Dashboard / CVE / CVE-2024-27298

    CVE-2024-27298

    parse-server is a Parse Server for Node.js / Express. This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database. The vulnerability has been fixed in 6.5.0 and 7.0.0-alpha.20.

    Published:Mar 1, 2024
    Last Modified:Dec 3, 2025
    EPS:Mar 1, 2024
    EPSS Score:0.00079
    CVSS Score:10

    Affected Products

    Vendor
    Parse Community
    Product
    Parse Server
    Vendor
    Parseplatform
    Product
    Parse-server

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-87806 (CVSS 9.1) — Parse Server versions <= 8.6.87 and >= 9.0.0 < 9.10.1-alpha.7 contain an authentication bypass in the built-in…
    CVE-2026-66009 (CVSS 6.3) — Parse Server versions >= 9.0.0 before 9.10.0-alpha.5 and >= 8.2.2 before 8.6.86 return GraphQL validation erro…
    CVE-2026-66008 (CVSS 6.3) — Parse Server versions >= 9.0.0 before 9.10.0-alpha.6 and >= 8.2.2 before 8.6.87 disclose Pointer and Relation …
    CVE-2026-64627 (CVSS 6.9) — Parse Server versions >= 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vu…
    CVE-2026-61448 (CVSS 2.1) — Parse Server is affected by a stored cross-site scripting (XSS) vulnerability in versions >= 9.0.0, < 9.10.0-a…
    CVE-2026-57481 (CVSS 2.3) — Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior …
    CVE-2026-57480 (CVSS 8.7) — Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior …
    CVE-2026-55778 (CVSS 2.1) — Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior …
    CVE-2026-53726 (CVSS 6.9) — Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior …
    CVE-2026-53725 (CVSS 5.9) — Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From v…

    References

    https://github.com/parse-community/parse-server/commit/a6e654943536932904a69b51e513507fcf90a504
    https://github.com/parse-community/parse-server/commit/cbefe770a7260b54748a058b8a7389937dc35833
    https://github.com/parse-community/parse-server/releases/tag/6.5.0
    https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.20
    https://github.com/parse-community/parse-server/security/advisories/GHSA-6927-3vr9-fxf2
    https://github.com/parse-community/parse-server/commit/a6e654943536932904a69b51e513507fcf90a504
    https://github.com/parse-community/parse-server/commit/cbefe770a7260b54748a058b8a7389937dc35833
    https://github.com/parse-community/parse-server/releases/tag/6.5.0
    https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.20
    https://github.com/parse-community/parse-server/security/advisories/GHSA-6927-3vr9-fxf2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High