The vulnerability CVE-2026-5660 affects itsourcecode Construction Management System 1.0. It is caused by improper handling of the 'emp' parameter in the /borrowed_equip.php file's Parameter Handler component, allowing an attacker to perform SQL injection. This can be triggered remotely without requiring user interaction or elevated privileges. The CVSS 4.0 base score is 5.3, indicating medium severity, with network attack vector, low complexity, and partial impact on confidentiality, integrity, and availability. No official fix or patch has been published, and no known exploits are currently observed in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated as medium severity with partial confidentiality, integrity, and availability impacts. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing input validation or web application firewall (WAF) rules to detect and block malicious SQL injection attempts targeting the 'emp' parameter in /borrowed_equip.php. Monitor for vendor updates regarding patches or official mitigations.