MingSoft MCMS EUVD-2026-54923

Q: What is the CVSS score of EUVD-2026-54923?

EUVD-2026-54923 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-19355 MEDIUM

SQL Injection (CWE-89)

2026-08-09 VulDB

GHSA-mgf9-vmjp-7q9v

SQLi Mcms Mingsoft

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-accessible unauthenticated endpoint with no complexity; limited C/I/A impact consistent with database-layer SQL injection without system scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Aug 09, 2026 - 14:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Aug 09, 2026 - 14:05 vuln.today

DescriptionCVE.org

A vulnerability was determined in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl.queryDiyFormData of the file /mdiy/form/data/list.do of the component ms-mdiy. Executing a manipulation of the argument formFields can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in MingSoft MCMS up to version 3.0.6 exposes the application's database to unauthenticated remote attackers via the formFields argument in the ModelDataImpl.queryDiyFormData function at /mdiy/form/data/list.do. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or special conditions are required, making the endpoint directly exploitable over the internet. A public exploit has been disclosed (E:P in CVSS 4.0 supplemental metrics), and the vendor failed to respond to responsible disclosure, leaving users without an official patch.

Technical ContextAI

MingSoft MCMS is a Java-based content management system. The affected component ms-mdiy handles dynamic form data queries. The vulnerable function ModelDataImpl.queryDiyFormData at the endpoint /mdiy/form/data/list.do accepts a formFields parameter and passes it into a SQL query without adequate sanitization or parameterized query binding, fulfilling the classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) root cause. The CPE string cpe:2.3:a:mingsoft:mcms:*:*:*:*:*:*:*:* with the upstream version cap of 3.0.6 indicates all known releases are affected. There is no evidence of a fixed release in the available data.

RemediationAI

No vendor-released patch has been identified at time of analysis; the vendor did not respond to disclosure. The primary recommended action is to block external access to the /mdiy/form/data/list.do endpoint via WAF rule or reverse proxy ACL - this eliminates the network attack vector with minimal trade-off for deployments where dynamic form data listing is not externally required. As a secondary control, implement a WAF signature targeting SQL metacharacter injection in the formFields parameter (e.g., detection of UNION, SELECT, single-quote sequences) to detect and block exploit attempts. If the ms-mdiy component is not required for business operations, disabling it reduces attack surface further. Organizations should also audit database user privileges assigned to the MCMS application account and restrict permissions to least privilege (SELECT-only where write is not needed) to limit the blast radius of a successful injection. Monitor VulDB at https://vuldb.com/vuln/387209 and the official MCMS repository for any patch release.