Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2026-19357: MingSoft MCMS ms-mdiy Leaks Sensitive Information Remotely
CVE-2026-19357 · published 2 months ago
Summary
An unknown function in MingSoft MCMS version 3.0.6 and earlier allows attackers to access sensitive information remotely. This could potentially expose confidential data. We recommend updating to the latest version of MingSoft MCMS to mitigate this risk.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| mingsoft | mcms | 3.0.0 |
Original advisory text
MingSoft MCMS ms-mdiy get information disclosure
A security flaw has been discovered in MingSoft MCMS up to 3.0.6. Affected is an unknown function of the file /mdiy/form/get of the component ms-mdiy. The manipulation results in information disclosure. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-200Information Exposure
CWE-284Improper Access Control
Timeline
Published9 Aug 2026
Updated4 Nov 2026
First seen9 Aug 2026
Track software like this
Free during beta