MingSoft MCMS CVE-2026-19356

Q: What is the CVSS score of CVE-2026-19356?

CVE-2026-19356 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-54924 MEDIUM

Information Exposure (CWE-200)

2026-08-09 VulDB

GHSA-7553-w66v-fvhr

Information Disclosure Mcms Mingsoft

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Network-accessible endpoint requiring no authentication or complexity; impact strictly limited to partial confidentiality with no integrity, availability, or scope-change effects.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 09, 2026 - 14:35 vuln.today

CVSS changed

Aug 09, 2026 - 14:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability was identified in MingSoft MCMS up to 3.0.6. This impacts an unknown function of the file /mdiy/form/data/list of the component ms-mdiy. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Information disclosure in MingSoft MCMS through version 3.0.6 exposes sensitive data via the /mdiy/form/data/list endpoint in the ms-mdiy component, exploitable by unauthenticated remote attackers with no configuration prerequisites. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivial network reachability, and a public exploit has been released (E:P). The vendor did not respond to responsible disclosure, leaving no official patch available at time of analysis.

Technical ContextAI

MingSoft MCMS is a Java-based content management system. The vulnerable component, ms-mdiy, handles custom form definitions and their submitted data; the /mdiy/form/data/list endpoint is responsible for listing form submission records. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) identifies the root cause as a missing or bypassed authorization check on this data-listing endpoint - the application returns form data without confirming the requester's identity or permission level. The CPE string cpe:2.3:a:mingsoft:mcms:*:*:*:*:*:*:*:* spans all MCMS application variants, with the version ceiling confirmed as 3.0.6 by VulDB.

RemediationAI

No vendor-released patch has been identified at time of analysis, as the vendor did not respond to responsible disclosure. The most actionable compensating control is to block or authenticate access to the /mdiy/form/data/list endpoint via a reverse proxy or WAF rule, ensuring only authenticated internal users can reach it - note this may break unauthenticated form submission workflows if ms-mdiy forms are public-facing. If the form data listing feature is not operationally required, disabling or removing the ms-mdiy module at the application configuration level eliminates the attack surface entirely. Organizations should monitor https://vuldb.com/vuln/387210 for patch availability updates and consider migrating to a maintained CMS if the vendor remains unresponsive.