CVE-2026-31840 SQL Injection via Dot-Notation Sort Parameter (PostgreSQL)

Detects Parse Server instances using PostgreSQL where the sort/order query parameter accepts dot-notation field names with unescaped single quotes in sub-field values. An attacker with the Application ID and REST API key (typically exposed in client-side code) can inject arbitrary SQL via the order parameter, enabling full database access.