CVE-2026-19356
Received Received - Intake

Information Disclosure in MingSoft MCMS

Publication date: 2026-08-09

Last updated on: 2026-08-09

Assigner: VulDB

Description
A vulnerability was identified in MingSoft MCMS up to 3.0.6. This impacts an unknown function of the file /mdiy/form/data/list of the component ms-mdiy. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-09
Last Modified
2026-08-09
Generated
2026-08-09
AI Q&A
2026-08-09
EPSS Evaluated
N/A
NVD
CVE-2026-19356
EUVD
EUVD-2026-54924

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mingsoft mcms to 3.0.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects MingSoft MCMS versions up to 3.0.6. It involves an unknown function in the file /mdiy/form/data/list within the ms-mdiy component. The issue allows unauthorized access to sensitive information, specifically leading to information disclosure. The attack can be executed remotely without requiring authentication.

Detection Guidance

This vulnerability involves an information disclosure issue in MingSoft MCMS up to version 3.0.6, specifically in the /mdiy/form/data/list component. Detection may involve checking for exposed endpoints or unusual data exposure in web requests targeting this path. No specific commands are provided in the context, but monitoring for requests to /mdiy/form/data/list and reviewing server logs for sensitive data leaks could help identify potential exploitation.

Impact Analysis

The vulnerability may allow attackers to remotely access and disclose sensitive information from your MCMS system. Since the exploit is publicly available, the risk of unauthorized access is increased. The lack of vendor response suggests no immediate patch, leaving systems exposed.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Immediately update MingSoft MCMS to the latest version beyond 3.0.6 if available. If no update exists, consider disabling the affected component /mdiy/form/data/list or restricting network access to it. Monitor network traffic for unusual data exfiltration attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19356. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart