MingSoft MCMS CVE-2026-19357

No special conditions are required beyond network reachability to the MCMS web application - the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote unauthenticated exploitation against the default deployment of MingSoft MCMS up to 3.0.6. The specific condition is that the ms-mdiy form builder component must be installed and its /mdiy/form/get route must be reachable; if the ms-mdiy module is not deployed or the endpoint is restricted by firewall or reverse proxy rules, exploitation is blocked. Exploitation is limited in impact to read-only information disclosure (no integrity or availability impact); the exact sensitivity of disclosed data depends on what forms have been created within the CMS instance. No user interaction, elevated privileges, or special configuration beyond a standard MCMS installation is required.

The CVSS 4.0 base score of 5.5 (Medium) is supported by a vector of AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N, indicating a fully remote, unauthenticated, zero-interaction attack path with low confidentiality impact confined to the vulnerable system and no integrity or availability impact. The threat signal is elevated by the E:P supplemental metric confirming a public proof-of-concept exploit exists, lowering the technical barrier to exploitation. The vulnerability is not listed in the CISA KEV catalog, and no EPSS data was provided in the intelligence feed. The absence of KEV listing and the low confidentiality impact (VC:L) suggest this is unlikely to be the primary attack vector in sophisticated campaigns, but the public exploit and PR:N authentication requirement make opportunistic mass scanning plausible. The vendor's non-response to pre-disclosure contact means no official characterization of the sensitive data exposed is available, making it difficult to precisely bound the business impact - the actual severity may be higher or lower depending on what the endpoint returns in practice.

A remote unauthenticated attacker sends a crafted HTTP GET request directly to the /mdiy/form/get endpoint of a publicly accessible MCMS 3.0.6 instance. The server processes the request without enforcing authentication and returns sensitive form-related data in the response body. A public proof-of-concept exploit simplifies this to a single HTTP request, making automated scanning and mass exploitation feasible with minimal attacker sophistication.