CVE-2025-53364

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Starting in 5.3.0 and before 7.5.3 and 8.2.2, the Parse Server GraphQL API previously allowed public access to the GraphQL schema without requiring a session token or the master key. While schema introspection reveals only metadata and not actual data, this metadata can still expand the potential attack surface. This vulnerability is fixed in 7.5.3 and 8.2.2.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-497

Affected software

No affected versions have been published.

Timeline

Published: Jul 10, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-533658.7The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.10.0, if a clie CVE-2025-533668.7The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.9.4, a validati CVE-2025-533678.4DjVuLibre is a GPL implementation of DjVu, a web-centric format for distributing documents and images. Prior to version 3.5.29, the MMRDecod CVE-2025-533685.4Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, page descriptions ar CVE-2025-533698.6Short Description is a MediaWiki extension that provides local short description support. In version 4.0.0, short descriptions are not prope CVE-2025-53375.4The Slider, Gallery, and Carousel by MetaSlider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘aria-label’ param CVE-2025-533705.4Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, short descriptions s CVE-2025-533719.1DiscordNotifications is an extension for MediaWiki that sends notifications of actions in your Wiki to a Discord channel. DiscordNotificatio CVE-2025-533727.5node-code-sandbox-mcp is a Node.js–based Model Context Protocol server that spins up disposable Docker containers to execute arbitrary JavaS CVE-2025-533738.9Natours is a Tour Booking API. The attacker can easily take over any victim account by injecting an attacker-controlled server domain in the CVE-2025-533744.3Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An auth CVE-2025-533756.5Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An auth