CVE-2026-19355

A vulnerability was determined in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl.queryDiyFormData of the file /mdiy/form/data/list.do of the component ms-mdiy. Executing a manipulation of the argument formFields can lead to sql injection. The attack may be performed from remot...

CVE-2026-19356

A vulnerability was identified in MingSoft MCMS up to 3.0.6. This impacts an unknown function of the file /mdiy/form/data/list of the component ms-mdiy. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit is publicly available and might be...

PT-2026-69296

Name of the Vulnerable Software and Affected Versions MingSoft MCMS versions prior to 3.0.7 Description A remote SQL injection exists within the ms-mdiy component. The issue occurs in the ModelDataImpl.queryDiyFormData function located at the '/mdiy/form/data/list.do' endpoint. An attacker can...

CVE-2026-19356: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability was identified in MingSoft MCMS up to 3.0.6. This impacts an unknown function of the file /mdiy/form/data/list of the component ms-mdiy. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit is publicly available and might be...