CVE-2026-19356CWE-200CWE-284broken-access-controlinformation-disclosure

CVE-2026-19356

Medium · published August 9, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
40.7
In the wild
Unconfirmed
What it is

A vulnerability was identified in MingSoft MCMS up to 3.0.6. This impacts an unknown function of the file /mdiy/form/data/list of the component ms-mdiy. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00483 · 40.7th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-284 · Improper Access Control
Published
2026-08-09T18:17Z
References (5)
https://vuldb.com/cve/CVE-2026-19356 · [email protected]https://vuldb.com/submit/865995 · [email protected]https://vuldb.com/vuln/387210 · [email protected]https://vuldb.com/vuln/387210/cti · [email protected]https://vuldb.com/submit/865995 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 09 AUG 13:45Z
    MingSoft MCMS ms-mdiy list information disclosure
    cvelistv5