This vulnerability in MingSoft MCMS up to version 3.0.6 allows remote attackers to disclose information by manipulating an unspecified function in the /mdiy/form/data/list file within the ms-mdiy component. The attack requires no privileges or user interaction and has a CVSS 4.0 base score of 6.9, indicating medium severity. The vendor has not provided any response or fix, and no official remediation is documented. Exploit code is publicly available, increasing the risk of exploitation.

Successful exploitation results in information disclosure, potentially exposing sensitive data handled by the affected component. The vulnerability can be triggered remotely without authentication or user interaction, which increases the attack surface. However, the exact nature and sensitivity of the disclosed information are not detailed in the available data.

No official patch or remediation is currently available, and the vendor has not responded to disclosure attempts. Users should monitor for any future vendor advisories or updates addressing this issue. Until a fix is released, consider restricting access to the affected endpoint (/mdiy/form/data/list) through network controls or web application firewalls to reduce exposure.