The vulnerability CVE-2026-6007 affects itsourcecode Construction Management System 1.0. It allows remote attackers to perform SQL injection by manipulating the equipname argument in the /del.php file. This can lead to unauthorized database queries or modifications. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. No official fix or patch has been published, and the vendor has not provided remediation details.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium due to limited confidentiality, integrity, and availability impact as per the CVSS vector. The vulnerability can be exploited remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the equipname parameter in /del.php. Additionally, review and restrict database permissions to minimize potential damage from injection attacks.