CVE-2026-19357
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A security flaw was discovered in MingSoft MCMS up to version 3.0.6, leading to information disclosure in an unknown function of the file /mdiy/form/get in the ms-mdiy component. The attack can be launched remotely. The exploit has been publicly released.
Risk Assessment
Information disclosure may allow an attacker to obtain sensitive data, potentially leading to confidentiality breaches. The publicly available exploit increases the risk of exploitation.
Recommendation
It is recommended to update MCMS to the latest version if available. Also restrict access to vulnerable files and monitor logs.
Other vulnerabilities in MingSoft MCMS
See all- CVE-2026-19356Medium
A vulnerability was identified in MingSoft MCMS up to version 3.0.6, leading to information disclosure in an unknown function of the file /mdiy/form/data/list in the ms-mdiy component. The attack can be initiated remotely. The exploit is publicly available.
- CVE-2026-19355High
A vulnerability was identified in MingSoft MCMS up to version 3.0.6, affecting the ModelDataImpl.queryDiyFormData function in the file /mdiy/form/data/list.do of the ms-mdiy component. Manipulating the formFields argument leads to SQL injection. The attack can be performed remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A security flaw has been discovered in MingSoft MCMS up to 3.0.6. Affected is an unknown function of the file /mdiy/form/get of the component ms-mdiy. The manipulation results in information disclosure. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS