CVE-2025-59333

The mcp-database-server (MCP Server) 1.1.0 and earlier, as distributed via the npm package @executeautomation/database-server, fails to implement adequate security controls to properly enforce a "read-only" mode. This vulnerability affects only the npm distribution; other distributions are not impacted. As a result, the server is susceptible to abuse and attacks on affected database systems such as PostgreSQL, and potentially others that expose elevated functionalities. These attacks may lead to denial of service and other unexpected behaviors.

• CWE-284

• https://github.com/executeautomation/mcp-database-server/security/advisories/GHSA-65hm-pwj5-73pwExploit, Vendor Advisory
• https://github.com/executeautomation/mcp-database-server/security/advisories/GHSA-65hm-pwj5-73pwExploit, Vendor Advisory

Published

Sep 16, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-59327In CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4, b…
• CVE-2025-59328A vulnerability in Apache Fory allows a remote attacker to c…6.5
• CVE-2025-5933The RD Contacto plugin for WordPress is vulnerable to Cross-…4.3
• CVE-2025-59330error-ex allows error subclassing and stack customization. O…8.8
• CVE-2025-59331is-arrayish checks if an object can be used like an Array. O…8.8
• CVE-2025-593323DAlloy is a lightWeight 3D-viewer for MediaWiki. From 1.0 t…8.6
• CVE-2025-59334Linkr is a lightweight file delivery system that downloads f…8.8
• CVE-2025-59335CubeCart is an ecommerce software solution. Prior to version…7.1
• CVE-2025-59336Luanox is a module host for Lua packages. Prior to 0.1.1, a …6.9
• CVE-2025-59337Discourse is an open-source community discussion platform. I…6.8
• CVE-2025-59339The Bastion provides authentication, authorization, traceabi…4.4
• CVE-2025-5934A vulnerability was found in Netgear EX3700 up to 1.0.0.88. …8.8