CVE-2026-19355Active Exploitation

LOWCVSS 5.5 · MEDIUM

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Prioritize remediation for affected systems immediately
Assume compromise if assets are exposed
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

A vulnerability was determined in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl.queryDiyFormData of the file /mdiy/form/data/list.do of the component ms-mdiy. Executing a manipulation of the argument formFields can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Back to dashboard

3.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-74CWE-89

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

Active exploitation appears in 1 classified signals
1 mentions across 1 observed day

What's happening

Active exploitation reported across 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Active Exploitation

1100.0%

Full discourse1 post

CyberSignal | Cybersecurity News@XQOPTRX46d
Active Exploitation
💉 MingSoft MCMS hit by another SQL injection CVE-2026-19355 affects MingSoft MCMS through 3.0.6. The flaw affects /mdiy/form/data/list.do and its handling of form-field data, potentially enabling SQL injection. 🔎 Source: CVE/Vulnerability feed via YANAC. #MCMS #SQLInjection #CVE #CyberSecurity
Post summary
MingSoft MCMS’s CVE‑2026‑19355, a SQL injection flaw in /mdiy/form/data/list.do, has reportedly been exploited, but no PoC, exploit code, or patch is provided in the text.
0000041
34 followersView on X

Explore more

Back to dashboard