MingSoft MCMS EUVD-2026-54928

Q: What is the CVSS score of EUVD-2026-54928?

EUVD-2026-54928 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-19357 MEDIUM

Information Exposure (CWE-200)

2026-08-09 VulDB

GHSA-mr8h-hjph-4g54

Information Disclosure Mcms Mingsoft

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Network-accessible endpoint, no authentication required, no user interaction, and only low confidentiality impact with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 09, 2026 - 15:35 vuln.today

CVSS changed

Aug 09, 2026 - 15:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

DescriptionCVE.org

A security flaw has been discovered in MingSoft MCMS up to 3.0.6. Affected is an unknown function of the file /mdiy/form/get of the component ms-mdiy. The manipulation results in information disclosure. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Unauthenticated information disclosure in MingSoft MCMS up to version 3.0.6 allows remote attackers to extract sensitive data via the /mdiy/form/get endpoint of the ms-mdiy component. The vulnerability requires no credentials or user interaction and is exploitable over the network, making it trivially accessible to any attacker with HTTP reach to the application. A public exploit has been released (CVSS 4.0 E:P), though the vulnerability is not currently listed in the CISA KEV catalog; the vendor did not respond to pre-disclosure notification, leaving no official patch available at time of analysis.

Technical ContextAI

MingSoft MCMS is a Java-based content management system produced by MingSoft, identified by CPE cpe:2.3:a:mingsoft:mcms:*:*:*:*:*:*:*:*. The affected component is the ms-mdiy form subsystem, specifically the GET handler for the /mdiy/form/get route, which appears to return form-related data without enforcing proper access control or authorization checks. The root cause maps to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), a class of flaw where an application discloses data to a principal that does not have explicit permission to view it. The endpoint likely serializes internal form metadata or configuration data in its response without verifying the caller's identity or authorization level, a common oversight in dynamic form builder modules of CMS platforms.

RemediationAI

No vendor-released patch has been identified at time of analysis; the vendor did not respond to pre-disclosure notification. Until an official fix is released, defenders should apply compensating controls: restrict network access to the /mdiy/form/get endpoint using a web application firewall or reverse proxy ACL, limiting access to authenticated internal users or known IP ranges only - note this may break legitimate form-fetching workflows if that endpoint is consumed by public-facing clients. Alternatively, deploy authentication middleware in front of the ms-mdiy module if the deployment architecture supports it. Monitor VulDB at https://vuldb.com/vuln/387211 and the vendor repository for any patch release. Users running MCMS beyond operational necessity should consider decommissioning the ms-mdiy component if dynamic form functionality is not required, reducing attack surface entirely.