parse-server prior to 3.4.1 allows DoS after any POST to a volatile class.
parseplatform parse-server