CVE-2026-19357
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A security flaw was discovered in MingSoft MCMS up to version 3.0.6, leading to information disclosure in an unknown function of the file /mdiy/form/get in the ms-mdiy component. The attack can be launched remotely. The exploit has been publicly released.
Risk Assessment
Information disclosure may allow an attacker to obtain sensitive data, potentially leading to confidentiality breaches. The publicly available exploit increases the risk of exploitation.
Recommendation
It is recommended to update MCMS to the latest version if available. Also restrict access to vulnerable files and monitor logs.
Original NVD description (English source)
A security flaw has been discovered in MingSoft MCMS up to 3.0.6. Affected is an unknown function of the file /mdiy/form/get of the component ms-mdiy. The manipulation results in information disclosure. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.