CVE-2026-11529

MediumCVSS 6.3/10Last modified Jul 23, 2026

Description

A vulnerability was determined in designcomputer mysql-mcp-server up to 0.2.2. The impacted element is the function read_resource of the file src/mysql_mcp_server/server.py of the component mysql URI Handler. This manipulation of the argument uri_str causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.3.0 is sufficient to resolve this issue. Patch name: 080bef9a96d625ce0dfbde573a08b93497871981. Upgrading the affected component is advised.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
designcomputer	mysql-mcp-server	0.2.0; 0.2.1; 0.2.2

References

Timeline

Published: Jun 8, 2026
Last modified: Jul 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1152907.5Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An una CVE-2026-1152924.3Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can lead to information disclosure via Accessing Funct CVE-2026-1152936.5Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to disclosure of the credentials tha CVE-2026-1152947.3Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in the Kibana Fleet feature can lead to unauthorized resource deletion CVE-2026-1152954.3Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Prop CVE-2026-1152976.5NULL Pointer Dereference (CWE-476) in the AMQP protocol parser in Packetbeat can lead to denial of service via specially crafted network tra CVE-2026-1152984.3Incorrect Authorization (CWE-863) in Elasticsearch can lead to information disclosure via Accessing Functionality Not Properly Constrained b CVE-2026-1152995.4The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings, allowing an atta CVE-2026-11534.3A vulnerability was detected in technical-laohu mpay up to 1.2.4. This affects an unknown function. Performing a manipulation results in cro CVE-2026-115307.3A vulnerability was identified in imvks786 student_management_system up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46. This affects an unknown CVE-2026-1153004.3The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only act CVE-2026-1153017.2The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows store