CVE-2026-5675
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
In itsourcecode Construction Management System 1.0, the file /borrowed_tool.php contains an SQL injection vulnerability via the emp parameter. An attacker can remotely manipulate this parameter, leading to unauthorized database access.
Risk Assessment
The risk includes potential theft, modification, or deletion of database data, as well as possible application takeover.
Recommendation
Apply the patch or update the software immediately, and implement input validation and sanitization for all parameters.
Original NVD description (English source)
A vulnerability was found in itsourcecode Construction Management System 1.0. This affects an unknown part of the file /borrowed_tool.php of the component Parameter Handler. The manipulation of the argument emp results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.