CVE-2026-5719
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
SQL Injection vulnerability in itsourcecode Construction Management System 1.0. An unknown function in /borrowedtool.php allows manipulation of the code argument, leading to SQL injection. Remote attack possible. Exploit published.
Risk Assessment
A remote attacker can execute arbitrary SQL queries, potentially leading to data leakage, modification, or database deletion.
Recommendation
Immediately update the Construction Management System to a patched version or apply proper security measures (e.g., parameterized queries).
Other vulnerabilities in itsourcecode Construction Management System
See all- CVE-2026-5823Medium
itsourcecode Construction Management System 1.0 has SQL Injection in /borrowed_tool_report.php via the Home argument. Remote attack possible, exploit public.
- CVE-2026-5675Medium
In itsourcecode Construction Management System 1.0, the file /borrowed_tool.php contains an SQL injection vulnerability via the emp parameter. An attacker can remotely manipulate this parameter, leading to unauthorized database access.
Original NVD description (English source)
A flaw has been found in itsourcecode Construction Management System 1.0. This affects an unknown function of the file /borrowedtool.php. Executing a manipulation of the argument code can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS