The vulnerability CVE-2026-5719 affects itsourcecode Construction Management System 1.0. It is caused by improper sanitization of the 'code' parameter in the /borrowedtool.php file, allowing an attacker to perform SQL injection remotely. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. No official fix or patch has been disclosed, and the vendor has not provided remediation details. Exploit code has been published but no active exploitation has been confirmed.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database of the Construction Management System, potentially leading to unauthorized data access or modification. The impact is rated medium due to limited confidentiality, integrity, and availability impact as per the CVSS vector. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to implement input validation and sanitization on the 'code' parameter in /borrowedtool.php to mitigate SQL injection risks. Monitor for updates from the vendor regarding patches or official mitigations.