CVE-2026-19356
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A vulnerability was identified in MingSoft MCMS up to version 3.0.6, leading to information disclosure in an unknown function of the file /mdiy/form/data/list in the ms-mdiy component. The attack can be initiated remotely. The exploit is publicly available.
Risk Assessment
Information disclosure may allow an attacker to access sensitive data, potentially leading to confidentiality breaches. The publicly available exploit increases the risk of attack.
Recommendation
It is recommended to update MCMS to the latest version if available. Also restrict access to vulnerable files and monitor logs.
Other vulnerabilities in MingSoft MCMS
See all- CVE-2026-19357Medium
A security flaw was discovered in MingSoft MCMS up to version 3.0.6, leading to information disclosure in an unknown function of the file /mdiy/form/get in the ms-mdiy component. The attack can be launched remotely. The exploit has been publicly released.
- CVE-2026-19355High
A vulnerability was identified in MingSoft MCMS up to version 3.0.6, affecting the ModelDataImpl.queryDiyFormData function in the file /mdiy/form/data/list.do of the ms-mdiy component. Manipulating the formFields argument leads to SQL injection. The attack can be performed remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability was identified in MingSoft MCMS up to 3.0.6. This impacts an unknown function of the file /mdiy/form/data/list of the component ms-mdiy. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS