CVE-2026-5675
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
In itsourcecode Construction Management System 1.0, the file /borrowed_tool.php contains an SQL injection vulnerability via the emp parameter. An attacker can remotely manipulate this parameter, leading to unauthorized database access.
Risk Assessment
The risk includes potential theft, modification, or deletion of database data, as well as possible application takeover.
Recommendation
Apply the patch or update the software immediately, and implement input validation and sanitization for all parameters.
Other vulnerabilities in itsourcecode Construction Management System
See all- CVE-2026-5823Medium
itsourcecode Construction Management System 1.0 has SQL Injection in /borrowed_tool_report.php via the Home argument. Remote attack possible, exploit public.
- CVE-2026-5719Medium
SQL Injection vulnerability in itsourcecode Construction Management System 1.0. An unknown function in /borrowedtool.php allows manipulation of the code argument, leading to SQL injection. Remote attack possible. Exploit published.
Original NVD description (English source)
A vulnerability was found in itsourcecode Construction Management System 1.0. This affects an unknown part of the file /borrowed_tool.php of the component Parameter Handler. The manipulation of the argument emp results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS