CVE-2026-5681
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
In itsourcecode sanitize or validate this input 1.0, the file /borrowedequip.php contains an SQL injection vulnerability via the emp_id parameter. An attacker can remotely manipulate this parameter, leading to unauthorized database access.
Risk Assessment
The risk includes potential theft, modification, or deletion of database data, as well as possible application takeover.
Recommendation
Apply the patch or update the software immediately, and implement input validation and sanitization for all parameters.
Original NVD description (English source)
A flaw has been found in itsourcecode sanitize or validate this input 1.0. This impacts an unknown function of the file /borrowedequip.php of the component Parameter Handler. This manipulation of the argument emp_id causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.