The vulnerability CVE-2026-5620 affects itsourcecode Construction Management System 1.0. It is an SQL injection flaw located in an unspecified function of the /borrowed_equip_report.php file's Parameter Handler component. By manipulating the 'Home' parameter, an attacker can inject SQL commands remotely. The CVSS 4.0 base score is 5.3, indicating medium severity, with network attack vector, low complexity, no privileges required, and no user interaction needed. The vulnerability has been publicly disclosed, but no official fix or patch has been provided by the vendor as of the publication date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database of the affected system. This may lead to unauthorized data access or modification. However, the CVSS vector indicates low impact on confidentiality, integrity, and availability, suggesting limited scope or partial impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is available, users should monitor vendor communications for updates. Until a patch is released, consider restricting access to the affected component or applying input validation and sanitization controls where possible to mitigate SQL injection risks.