The vulnerability CVE-2026-19355 exists in MingSoft MCMS up to version 3.0.6 within the ModelDataImpl.queryDiyFormData function of the ms-mdiy component. By manipulating the formFields argument in the /mdiy/form/data/list.do endpoint, an attacker can execute SQL injection attacks remotely. This flaw allows unauthorized access or modification of the database through crafted input. The vulnerability has been publicly disclosed, but the vendor has not provided any response or patch to date.

Successful exploitation of this SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, data modification, or other impacts depending on the database and application context. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should consider implementing application-layer protections such as input validation and web application firewalls to mitigate exploitation risk until an official patch is released.