CVE-2026-19355 | MingSoft MCMS up to 3.0.6 ms-mdiy /mdiy/form/data/list.do ModelDataImpl.queryDiyFormData formFields sql injection

A vulnerability labeled as critical has been found in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl.queryDiyFormData of the file /mdiy/form/data/list.do of the component ms-mdiy. Executing a manipulation of the argument formFields can lead to sql injection.

This vulnerability appears as CVE-2026-19355. The attack may be performed from remote. In addition, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.