UpHeron
All vulnerabilities

Servers and applications

CVE-2024-27298

parse-server is a Parse Server for Node.js / Express. This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database. The vulnerability has been fixed in 6.5.0 and 7.0.0-alpha.20.

Severity
Critical 10.0
Published
1 Mar 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
6.5.0
Sources
NVD

Affected software

SoftwareAffected versions
Parse ServerServers and applications · cpe:a:parseplatform:parse-server
  • Version 7.0.0-alpha19
  • Version 7.0.0-alpha18
  • Version 7.0.0-alpha17
  • Version 7.0.0-alpha16
All 23 release lines
  • Every version before 6.5.0
  • Version 6.5.0-alpha1
  • Version 6.5.0-alpha2
  • Version 6.5.0-beta1
  • Version 7.0.0-alpha1
  • Version 7.0.0-alpha2
  • Version 7.0.0-alpha3
  • Version 7.0.0-alpha4
  • Version 7.0.0-alpha5
  • Version 7.0.0-alpha6
  • Version 7.0.0-alpha7
  • Version 7.0.0-alpha8
  • Version 7.0.0-alpha9
  • Version 7.0.0-alpha10
  • Version 7.0.0-alpha11
  • Version 7.0.0-alpha12
  • Version 7.0.0-alpha13
  • Version 7.0.0-alpha14
  • Version 7.0.0-alpha15
  • Version 7.0.0-alpha16
  • Version 7.0.0-alpha17
  • Version 7.0.0-alpha18
  • Version 7.0.0-alpha19

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-27298
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-27298