CVE-2026-19355 identifies a SQL injection vulnerability in MingSoft MCMS up to version 3.0.6. The flaw exists in the ModelDataImpl.queryDiyFormData function of the ms-mdiy component, specifically in the handling of the formFields parameter in the /mdiy/form/data/list.do file. This improper input validation allows remote attackers to inject malicious SQL commands. The vulnerability has been publicly disclosed, but the vendor has not provided any response or patch. The CVSS 3.1 base score is 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), reflecting a remotely exploitable vulnerability with low attack complexity and no required privileges or user interaction.

Successful exploitation could allow an attacker to execute arbitrary SQL commands remotely, potentially leading to unauthorized data disclosure, data modification, or denial of service. The vulnerability impacts confidentiality, integrity, and availability of the affected system. However, no active exploitation in the wild has been reported to date.

No official patch or remediation has been provided by the vendor as of the current information. Users should monitor vendor communications for updates. Until a fix is available, consider restricting access to the vulnerable endpoint and applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the formFields parameter.