Description
A vulnerability was determined in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl.queryDiyFormData of the file /mdiy/form/data/list.do of the component ms-mdiy. Executing a manipulation of the argument formFields can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-08-09
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a classic SQL injection in the MingSoft MCMS ms-mdiy component, specifically within the ModelDataImpl.queryDiyFormData method handling the formFields argument. A malicious user can supply crafted input that is directly incorporated into a database query, enabling unauthorized data read, modification, or potential command execution. The impact therefore is loss of data integrity and confidentiality of the underlying database contents.

Affected Systems

The affected product is MingSoft MCMS, with all versions up to and including 3.0.6 susceptible to this flaw. No other products or versions are listed as affected.

Risk and Exploitability

The CVSS base score of 6.9 indicates moderate severity, but the vulnerability is exploitable remotely and has been publicly disclosed, increasing the likelihood of real‑world attacks. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog. Because the flaw can be triggered from an external network, organizations should consider it a high risk for any exposed installation and prioritize patching or mitigation promptly.

Generated by OpenCVE AI on August 9, 2026 at 14:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑supplied patch or upgrade MingSoft MCMS to a version newer than 3.0.6 that removes the vulnerable code.
  • Restrict access to the /mdiy/form/data/list.do endpoint to trusted internal networks or approved IP addresses using firewall or web application firewall rules.
  • Add server‑side input validation and enforce the use of parameterized queries or prepared statements for the formFields parameter to prevent injection.

Generated by OpenCVE AI on August 9, 2026 at 14:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 09 Aug 2026 13:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl.queryDiyFormData of the file /mdiy/form/data/list.do of the component ms-mdiy. Executing a manipulation of the argument formFields can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Title MingSoft MCMS ms-mdiy list.do ModelDataImpl.queryDiyFormData sql injection
First Time appeared Mingsoft
Mingsoft mcms
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:mingsoft:mcms:*:*:*:*:*:*:*:*
Vendors & Products Mingsoft
Mingsoft mcms
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Mingsoft Mcms
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-09T13:30:09.885Z

Reserved: 2026-08-08T18:44:39.666Z

Link: CVE-2026-19355

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-09T14:30:01Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')