CVE-2026-5620
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
SQL Injection vulnerability in Construction Management System 1.0. An unknown function in the file /borrowed_equip_report.php allows manipulation of the Home argument, leading to SQL injection. The attack can be performed remotely, and the exploit is publicly available.
Risk Assessment
An attacker can remotely steal, modify, or delete data from the construction management system's database, potentially compromising data confidentiality and integrity.
Recommendation
Immediately update the system to the latest version or apply a security patch to prevent SQL injection, such as input validation and parameterized queries.
Original NVD description (English source)
A vulnerability has been found in itsourcecode Construction Management System 1.0. Affected is an unknown function of the file /borrowed_equip_report.php of the component Parameter Handler. The manipulation of the argument Home leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.