MingSoft MCMS CVE-2026-19355

No special conditions are required for exploitation - the CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N indicates remote unauthenticated exploitation against default configurations of MingSoft MCMS. The only prerequisite is that the /mdiy/form/data/list.do endpoint of the ms-mdiy component is network-accessible, which is expected in a standard MCMS deployment. Exploitation is limited to MCMS versions up to and including 3.0.6; the impact is bounded to the database layer (VC:L/VI:L/VA:L) with no confirmed OS-level or subsequent-system compromise. No user interaction or elevated privilege is needed.

The CVSS 4.0 base score of 6.9 reflects moderate impact (VC:L/VI:L/VA:L) despite trivial exploitability (AV:N/AC:L/AT:N/PR:N/UI:N), which is consistent with a standard error-based or union-based SQL injection that leaks or tampers with data rather than achieving full system compromise. No EPSS data was provided, so exploitation probability cannot be quantified from probability models. The E:P supplemental metric confirms a public proof-of-concept exists, which meaningfully elevates real-world risk beyond what the base score alone suggests. This is NOT in CISA KEV, so confirmed active exploitation is not established. The vendor's non-response to disclosure is a notable compounding factor - no patch exists, no advisory was issued, and defenders have no official guidance. The combination of unauthenticated network exploitability, public POC, and absent vendor response makes this a real operational priority for organizations running MCMS despite the moderate CVSS score.

A remote, unauthenticated attacker sends a crafted HTTP GET or POST request to /mdiy/form/data/list.do with a SQL payload embedded in the formFields parameter - for example, injecting a UNION SELECT statement to enumerate database tables or extract credential hashes. Because no authentication is required and the endpoint is exposed over the network, the attack requires no prior foothold. A public proof-of-concept has been disclosed, lowering the skill bar for exploitation.