CVE-2025-68115Medium· 6.1▾ SunlitParse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 8.6.1 and 9.1.0-alpha.3, a Reflected Cross-Site Scripting (XSS) vulnerability exists in Parse Server's password …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 8.6.1 and 9.1.0-alpha.3, a Reflected Cross-Site Scripting (XSS) vulnerability exists in Parse Server's password reset and email verification HTML pages. The patch, available in versions 8.6.1 and 9.1.0-alpha.3, escapes user controlled values that are inserted into the HTML pages. No known workarounds are available.
parse-server < 8.6.1parse-server = 9.0.0parse-server = 9.1.0Upgrade past the affected range:
parse-server 8.6.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-53724Lowparse-server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist
GHSA-p6c5-mjgj-m4rmLowDuplicate Advisory: Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist
CVE-2026-116801Medium· 4.3Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query
CVE-2026-116162Low· 2.1Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login
CVE-2026-116161Medium· 6.0Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions
CVE-2026-116163High· 7.4Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses