{"id":"EUVD-2025-203485","enisaUuid":"c3aefe52-221c-3c58-b48d-a2e1fadb89c2","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 8.6.1 and 9.1.0-alpha.3, a Reflected Cross-Site Scripting (XSS) vulnerability exists in Parse Server\u0027s password reset and email verification HTML pages. The patch, available in versions 8.6.1 and 9.1.0-alpha.3, escapes user controlled values that are inserted into the HTML pages. No known workarounds are available.","datePublished":"Dec 16, 2025, 12:56:23 AM","dateUpdated":"Dec 16, 2025, 9:20:24 PM","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/parse-community/parse-server/security/advisories/GHSA-jhgf-2h8h-ggxv\nhttps://github.com/parse-community/parse-server/pull/9985\nhttps://github.com/parse-community/parse-server/pull/9986\n","aliases":"CVE-2025-68115\nGHSA-jhgf-2h8h-ggxv\n","assigner":"GitHub_M","epss":0.22,"enisaIdProduct":[{"id":"4433defa-f30f-391f-aba9-bd74a0b88ff0","product":{"name":"parse-server","vendor":{"name":"parse-community"}},"product_version":"\u003c 8.6.1"},{"id":"be0ea804-331f-3dd3-99f7-7e5500ef0930","product":{"name":"parse-server","vendor":{"name":"parse-community"}},"product_version":"9.0.0, \u003c 9.1.0-alpha.3"}],"enisaIdVendor":[{"id":"6e1f7510-9a29-3406-a32b-5b555bc7a20c","vendor":{"name":"parse-community"}}],"enisaIdVulnerability":[{"id":"2165c9c3-de11-35dc-b2c7-8c32fa5fad3e","vulnerability":{"id":"GHSA-jhgf-2h8h-ggxv","description":"Parse Server has a Cross-Site Scripting (XSS) vulnerability via Unescaped Mustache Template Variables","datePublished":"Dec 16, 2025, 7:36:37 PM","dateUpdated":"Dec 16, 2025, 7:36:37 PM","baseScore":0.0,"references":"https://github.com/parse-community/parse-server/security/advisories/GHSA-jhgf-2h8h-ggxv\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-68115\nhttps://github.com/parse-community/parse-server/pull/9985\nhttps://github.com/parse-community/parse-server/pull/9986\nhttps://github.com/parse-community/parse-server\n","enisa_id":"EUVD-2025-203485\n","aliases":"CVE-2025-68115\nGHSA-jhgf-2h8h-ggxv\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:56:58 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"27bfa4f1-2cb3-37ed-bf10-70ef2a1a14e9","vulnerability":{"id":"CVE-2025-68115","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 8.6.1 and 9.1.0-alpha.3, a Reflected Cross-Site Scripting (XSS) vulnerability exists in Parse Server\u0027s password reset and email verification HTML pages. The patch, available in versions 8.6.1 and 9.1.0-alpha.3, escapes user controlled values that are inserted into the HTML pages. No known workarounds are available.","datePublished":"Dec 16, 2025, 12:56:23 AM","dateUpdated":"Dec 16, 2025, 9:20:24 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/parse-community/parse-server/security/advisories/GHSA-jhgf-2h8h-ggxv\nhttps://github.com/parse-community/parse-server/pull/9985\nhttps://github.com/parse-community/parse-server/pull/9986\n","enisa_id":"EUVD-2025-203485\n","assigner":"GitHub_M","epss":0.22,"dataProcessed":"Nov 6, 2026, 7:14:06 AM","vulnerabilityProduct":[{"id":"a3101a39-85e8-31e1-bc34-e7edf6a6c1d1","product":{"name":"parse-server","vendor":{"name":"parse-community"}},"product_version":"\u003c 8.6.1"},{"id":"fbdb4588-8d2b-383b-849c-5a0e5a481bea","product":{"name":"parse-server","vendor":{"name":"parse-community"}},"product_version":"9.0.0, \u003c 9.1.0-alpha.3"}],"vulnerabilityVendor":[{"id":"878d0287-ef7d-3a6b-b437-141548e26862","vendor":{"name":"parse-community"}}]}}],"enisaIdAdvisory":[]}