CVE-2026-19356
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A vulnerability was identified in MingSoft MCMS up to version 3.0.6, leading to information disclosure in an unknown function of the file /mdiy/form/data/list in the ms-mdiy component. The attack can be initiated remotely. The exploit is publicly available.
Risk Assessment
Information disclosure may allow an attacker to access sensitive data, potentially leading to confidentiality breaches. The publicly available exploit increases the risk of attack.
Recommendation
It is recommended to update MCMS to the latest version if available. Also restrict access to vulnerable files and monitor logs.
Original NVD description (English source)
A vulnerability was identified in MingSoft MCMS up to 3.0.6. This impacts an unknown function of the file /mdiy/form/data/list of the component ms-mdiy. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.