CVE-2025-67727
NoneCVSS
—
EPSS
0.4%
Published
Dec 12, 2025
CISA due date
—
The record
Parse Server GitHub CI workflow vulnerable to RCE through Improper Privilege Management
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Bitnami | parse | 0 | 8.6.0 |
| Bitnami | parse | 0 | 8.6.0-alpha.2 |
Related vulnerabilities
- GHSA-3f5f-xgrj-97pf Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth… Also affects parse
- GHSA-jhgf-2h8h-ggxv Parse Server has a Cross-Site Scripting (XSS) vulnerability via Unescaped Mustache… Also affects parse
- CVE-2025-68150 Parse Server has Server-Side Request Forgery (SSRF) in Instagram OAuth Adapter Also affects parse
- CVE-2025-68115 Parse Server vulnerable to Cross-Site Scripting (XSS) via Unescaped Mustache Template… Also affects parse
- GHSA-7cx5-254x-cgrq Parse Server allows public `explain` queries which may expose sensitive database… Also affects parse
- CVE-2025-64502 Parse Server is an open source backend that can be deployed to any infrastructure that… Also affects parse
- CVE-2025-64430 Parse Server is an open source backend that can be deployed to any infrastructure that… Also affects parse
- GHSA-x4qj-2f4q-r4rx Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI… Also affects parse