Eternity

**Name of the Vulnerable Software and Affected Versions** ArtMin96 yii2-mcp-server version 1.0.2 **Description** A flaw in the MCP Interface component, specifically within the `yii command help/yii execute command()` function of the `src/index.ts` file, allows for remote OS command injection. This occurs when a manipulation is executed, potentially leading to complete server compromise. **Recommendations** Remove version 1.0.2. As a temporary workaround, restrict access to the `yii command help/yii execute command()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** astro-mcp-server versions prior to 1.1.2 **Description** A flaw in the MCP Tool Query Construction component, specifically within a function in the `src/index.ts` file, allows for remote SQL injection. This occurs when the `request.params.arguments` argument is manipulated. SQL injection is a technique where an attacker inserts malicious SQL code into a query, potentially allowing them to view, modify, or delete data from the database. **Recommendations** Update to version 1.1.2 or later. As a temporary workaround, restrict or validate the input passed to the `request.params.arguments` argument to prevent malicious SQL code execution.

**Name of the Vulnerable Software and Affected Versions** Dayoooun hwpx-mcp version 0.2.0 **Description** An issue exists in the MCP Interface component within the file mcp-server/src/index.ts. Manipulation of the `output path` argument in the `save document()`, `export to text()`, and `export to html()` functions allows for path traversal, which is a method used to access files and directories that are stored outside the intended folder. This flaw enables remote exploitation. **Recommendations** As a temporary workaround, consider restricting the use of the `output path` argument in the `save document()`, `export to text()`, and `export to html()` functions until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Flux159 mcp-game-asset-gen version 0.1.0 **Description** A path traversal issue exists in the MCP Interface component within the `image to 3d async()` function of the `src/index.ts` file. This flaw allows remote attackers to perform path traversal by manipulating the `statusFile` argument. **Recommendations** As a temporary workaround, restrict the use of the `image to 3d async()` function or carefully validate the `statusFile` argument to prevent unauthorized file system access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sunwood-ai-labs command-executor-mcp-server versions prior to 0.1.1 **Description** An OS command injection flaw exists in the MCP Interface component within the `execute command()` function of the `src/index.ts` file. This allows for remote code execution (RCE), which is the ability of an attacker to execute arbitrary commands on a target machine. **Recommendations** As a temporary workaround, consider restricting the use of the `execute command()` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** VetCoders mcp-server-semgrep version 1.0.0 **Description** Remote OS command injection is possible within the MCP Interface component in the file `src/index.ts`. The issue occurs when the `ID` argument is manipulated, affecting the functions `analyze results()`, `filter results()`, `export results()`, `compare results()`, `scan directory()`, and `create rule()`. **Recommendations** Upgrade to version 1.0.1.

**Name of the Vulnerable Software and Affected Versions** ZachHandley ZMCPTools versions prior to 0.2.3 **Description** A path traversal issue exists in the MCP Log Resource Handler component within the file src/managers/ResourceManager.ts. The flaw allows remote exploitation through the manipulation of the `dirname` argument. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** mcp-dnstwist versions prior to 1.0.5 **Description** A weakness in the MCP Interface component allows for remote OS command injection. The issue exists within the `fuzz domain()` function located in the `src/index.ts` file, where improper handling of the `Request` argument enables the execution of arbitrary operating system commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `fuzz domain()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Algovate xhs-mcp version 0.8.11 **Description** An issue exists in the MCP Interface component within the `xhs publish content()` function of the `src/server/mcp.server.ts` file. A remote attacker can perform server-side request forgery (SSRF)—a flaw that allows a server to be coerced into making unintended requests—by manipulating the `media paths` argument. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the `xhs publish content()` function or carefully validate the `media paths` argument to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** PolarVista xcode-mcp-server version 1.0.0 **Description** An OS command injection issue exists in the MCP Interface component within the `build project/run tests` function of the `src/index.ts` file. This flaw allows a remote attacker to execute arbitrary operating system commands by manipulating the `Request` argument. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the `build project/run tests` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** D-Link DI-500WF-WT versions up to 20250511 **Description** A critical issue has been found, affecting the function `sub 456DE8` of the file "/msp info.htm?flag=cmd" in the component "/usr/sbin/jhttpd". The manipulation of the `cmd` argument leads to command injection. This issue can be exploited remotely. **Recommendations** For D-Link DI-500WF-WT versions up to 20250511, as a temporary workaround, consider restricting access to the "/msp info.htm?flag=cmd" endpoint to minimize the risk of exploitation. Avoid using the `cmd` argument in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.