CVE-2025-68115

Katalog CVE

CVSS 6.1 · Medium EPSS 0,22%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada parseplatform parse-server. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 8.6.1 and 9.1.0-alpha.3, a Reflected Cross-Site Scripting (XSS) vulnerability exists in Parse Server's password reset and email verification HTML pages. The patch, available in versions 8.6.1 and 9.1.0-alpha.3, escapes user controlled values that are inserted into the HTML pages. No known workarounds are available.

Rincian

Terbit di NVD

16 Desember 2025

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,22% peluang dieksploitasi; lebih tinggi dari 11,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/parse-community/parse-server/security/advisories/GHSA-jhgf-2h8h-ggxv advisory vendor
• https://github.com/parse-community/parse-server/pull/9985 issue tracking · patch
• https://github.com/parse-community/parse-server/pull/9986 issue tracking · patch