This vulnerability affects MingSoft MCMS up to version 3.0.6 in the ms-mdiy component, specifically in an unknown function of the /mdiy/form/get file. Exploiting this flaw allows an unauthenticated remote attacker to disclose information. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality impact. The vendor has not provided a fix or response, and an exploit has been publicly released.

An attacker can remotely exploit this vulnerability to disclose sensitive information from the affected system without requiring authentication. This could lead to exposure of data that may aid further attacks or compromise confidentiality. There is no indication of integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for vendor updates and consider applying compensating controls such as restricting access to the vulnerable endpoint until a patch is released.