CVE•Published 2026-06-12•Modified 2026-06-15•0 articles on news•4 live references•NVD data

CVE-2026-47248

Vulnerability data via NVD (ingested)

CVSS v3.1

—

EPSS percentile

Exploit Prediction Scoring System · top 88% of all CVEs

Weaknesses (CWE)

CWE-209Generation of Error Message Containing Sensitive Information

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.78 and 9.9.1-alpha.2, Parse Server's GraphQL endpoint discloses schema metadata to unauthenticated callers through Did you mean ...? suggestions embedded in GraphQL validation-error messages. An unauthenticated caller who knows only the public application id can iteratively send malformed queries to reconstruct class names, field names, argument names, mutation names, and input-object fields. This issue has been patched in versions 8.6.78 and 9.9.1-alpha.2.

Timeline

Published 2026-06-12

Modified 2026-06-15

External references

NVD MITRE Exploit-DB VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common). Live host counts are a Premium feature.

Shodan · vuln tag

vuln:CVE-2026-47248

Hosts Shodan has explicitly fingerprinted as vulnerable.

More intel sources (5)

Shodan report

vuln:CVE-2026-47248

Country / ASN / product breakdown for the vuln query.

Censys

vulnerabilities.cve_id: CVE-2026-47248

Censys host search filtered to this CVE id.

grep.app

CVE-2026-47248