Threats tagged 'ghsa-mgf9-vmjp-7q9v'

MingSoft MCMS versions up to 3.0.6 contain a SQL injection vulnerability in the ms-mdiy component's ModelDataImpl.queryDiyFormData function. The flaw arises from improper handling of the formFields argument in the /mdiy/form/data/list.do endpoint, allowing remote attackers to manipulate SQL queries. The vulnerability has a high severity score of 7.3 and public exploit code has been disclosed. The vendor has not responded or provided a fix.