The vulnerability CVE-2026-5719 affects itsourcecode Construction Management System 1.0. It arises from improper sanitization of the 'code' parameter in the /borrowedtool.php file, allowing an attacker to perform SQL injection remotely. This can potentially lead to unauthorized database queries or data manipulation. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and low impacts on confidentiality, integrity, and availability. No official fix or vendor advisory is currently provided.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database via the manipulated 'code' parameter. This may result in unauthorized data access or modification. However, the impact is rated as low to medium on confidentiality, integrity, and availability, and no active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected endpoint, applying web application firewall rules to detect and block SQL injection attempts targeting the 'code' parameter, and monitoring for suspicious activity related to /borrowedtool.php. Avoid relying on generic mitigations unless specifically applicable.