CVE-2026-19356 is an information disclosure vulnerability in MingSoft MCMS versions up to 3.0.6. It involves an unknown function in the /mdiy/form/data/list file of the ms-mdiy component. The vulnerability allows remote attackers to disclose information without requiring privileges or user interaction. Although an exploit is publicly available, the vendor has not responded or issued a fix. The CVSS 3.1 base score is 5.3, reflecting a moderate impact on confidentiality with no impact on integrity or availability.

Successful exploitation leads to unauthorized disclosure of information from the affected MingSoft MCMS system. There is no impact on system integrity or availability. The vulnerability can be triggered remotely without authentication, increasing the risk of exposure. However, no active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor official MingSoft channels for updates. In the meantime, restricting access to the vulnerable endpoint and applying network-level controls may reduce exposure.