CVE-2026-5719
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
SQL Injection vulnerability in itsourcecode Construction Management System 1.0. An unknown function in /borrowedtool.php allows manipulation of the code argument, leading to SQL injection. Remote attack possible. Exploit published.
Risk Assessment
A remote attacker can execute arbitrary SQL queries, potentially leading to data leakage, modification, or database deletion.
Recommendation
Immediately update the Construction Management System to a patched version or apply proper security measures (e.g., parameterized queries).
Original NVD description (English source)
A flaw has been found in itsourcecode Construction Management System 1.0. This affects an unknown function of the file /borrowedtool.php. Executing a manipulation of the argument code can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used.