CVE-2026-19355
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A vulnerability was identified in MingSoft MCMS up to version 3.0.6, affecting the ModelDataImpl.queryDiyFormData function in the file /mdiy/form/data/list.do of the ms-mdiy component. Manipulating the formFields argument leads to SQL injection. The attack can be performed remotely, and the exploit has been publicly disclosed.
Risk Assessment
An attacker can remotely manipulate SQL queries, potentially leading to unauthorized data access or modification. The publicly available exploit increases the risk of exploitation.
Recommendation
It is recommended to immediately update MCMS to the latest available version if one exists. Additionally, restrict access to vulnerable endpoints and monitor logs for suspicious queries.
Other vulnerabilities in MingSoft MCMS
See all- CVE-2026-19357Medium
A security flaw was discovered in MingSoft MCMS up to version 3.0.6, leading to information disclosure in an unknown function of the file /mdiy/form/get in the ms-mdiy component. The attack can be launched remotely. The exploit has been publicly released.
- CVE-2026-19356Medium
A vulnerability was identified in MingSoft MCMS up to version 3.0.6, leading to information disclosure in an unknown function of the file /mdiy/form/data/list in the ms-mdiy component. The attack can be initiated remotely. The exploit is publicly available.
Original NVD description (English source)
A vulnerability was determined in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl.queryDiyFormData of the file /mdiy/form/data/list.do of the component ms-mdiy. Executing a manipulation of the argument formFields can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.