Is CVE-2025-68115 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-68115 being exploited in the wild.

How severe is CVE-2025-68115?

Medium severity, with a CVSS score of 6.1, published 16 December 2025.

Which products and versions are affected?

parse-server (npm) SEMVER:introduced=0,fixed=8.6.1.

Is there a fix for CVE-2025-68115?

Yes. parse-server (npm): upgrade to 8.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-68115 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-68115?

Check whether you run parse-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-68115: Parse Server cross-site scripting in password reset and email verification

CVE-2025-68115 · Severity: medium · CVSS 6.1 · Published 2025-12-16

Parse Server is a backend-as-a-service platform that handles user authentication and account management for applications. A cross-site scripting (XSS) vulnerability in the password reset and email verification pages allows attackers to inject malicious scripts that execute in users' browsers when they visit these pages, potentially stealing session tokens, credentials, or sensitive information.

Technologies: parse-server (npm). Vendors: npm.

Quick answers

Is CVE-2025-68115 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-68115 being exploited in the wild.
How severe is CVE-2025-68115?: Medium severity, with a CVSS score of 6.1, published 16 December 2025.
Which products and versions are affected?: parse-server (npm) SEMVER:introduced=0,fixed=8.6.1.
Is there a fix for CVE-2025-68115?: Yes. parse-server (npm): upgrade to 8.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-68115 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-68115?: Check whether you run parse-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

parse-server (npm): upgrade to 8.6.1 or later
```
npm install parse-server@8.6.1
```

Technical details

A Reflected Cross-Site Scripting (XSS) vulnerability exists in Parse Server's password reset and email verification HTML pages (CWE-79). The vulnerability stems from unescaped Mustache template variables that directly insert user-controlled values into the HTML output without proper sanitization. The attack vector is network-based with no privilege requirement and only requires passive user interaction (user clicks a link). An attacker can craft a malicious URL containing XSS payloads that execute in the context of the vulnerable pages when a user visits them. The vulnerability is fixed in versions 8.6.1 and 9.1.0-alpha.3 and later, with patches escaping user-controlled values before HTML insertion.

Affected products

Parse Community Parse Server before 8.6.1 and 9.0.0 before 9.1.0-alpha.3

Identifiers

CVE-2025-68115
GHSA-jhgf-2h8h-ggxv

Timeline

2025-12-16: disclosed
2025-12-16: patched: Patches released as versions 8.6.1 and 9.1.0-alpha.3

References

https://github.com/parse-community/parse-server/security/advisories/GHSA-jhgf-2h8h-ggxv

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.