CVE-2024-39309

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A vulnerability in versions prior to 6.5.7 and 7.1.0 allows SQL injection when Parse Server is configured to use the PostgreSQL database. The algorithm to detect SQL injection has been improved in versions 6.5.7 and 7.1.0. No known workarounds are available.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89 CWE-288

Affected software

No affected versions have been published.

Timeline

Published: Jul 1, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-39315.4A vulnerability was found in Totara LMS up to 18.7. It has been rated as problematic. Affected by this issue is some unknown functionality o CVE-2024-393105.4The Basil recipe theme for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the `post_title` parameter in versions up to CVE-2024-393115.4Publify is a self hosted Web publishing platform on Rails. Prior to version 10.0.1 of Publify, corresponding to versions prior to 10.0.2 of CVE-2024-393125.3Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit enc CVE-2024-393135.3toy-blog is a headless content management system implementation. Starting in version 0.5.4 and prior to version 0.6.1, articles with private CVE-2024-393144.7toy-blog is a headless content management system implementation. Starting in version 0.4.3 and prior to version 0.5.0, the administrative pa CVE-2024-393156.5Pomerium is an identity and context-aware access proxy. Prior to version 0.26.1, the Pomerium user info page (at `/.pomerium`) unintentional CVE-2024-393166.5Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.5, Regular Expression Denial of Service (ReD CVE-2024-393174.9Wagtail is an open source content management system built on Django. A bug in Wagtail's `parse_query_string` would result in it taking a lon CVE-2024-393185.4The Ibexa Admin UI Bundle contains all the necessary parts to run the Ibexa DXP Back Office interface. The file upload widget is vulnerable CVE-2024-393195.3aimeos/ai-controller-frontend is the Aimeos frontend controller package for e-commerce projects. Prior to versions 2024.4.2, 2023.10.9, 2022 CVE-2024-39323.1A vulnerability classified as problematic has been found in Totara LMS up to 18.7. This affects an unknown part of the component User Select