CVE-2026-105828

— UNSCOREDpublic exploit available

Published 2026-10-08 · Updated 2026-10-08

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an information disclosure vulnerability in which GraphQL validation error messages reveal hidden class names when public introspection is disabled. Unauthenticated attackers holding only the public Application Id can send crafted operations triggering unknown-argument or invalid enum value errors to learn pointer and relation target classes.

Weaknesses

CWE-209

Public exploit & PoC references

https://github.com/parse-community/parse-server/security/advisories/GHSA-6m77-f8xr-f723

All references

https://github.com/parse-community/parse-server/security/advisories/GHSA-6m77-f8xr-f723
https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.1-alpha.12-class-name-disclosure-via-graphql-errors

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2025-1350
MEDIUMCVE-2026-100677PoC
MEDIUMCVE-2026-101029PoC
MEDIUMCVE-2026-102904PoC
MEDIUMCVE-2026-1030
UNSCOREDCVE-2026-105283PoC
MEDIUMCVE-2026-105707PoC
HIGHCVE-2026-110889

Related by shared AI tags and CWE weakness class. Browse the full archive.