The vulnerability CVE-2026-6190 affects itsourcecode Construction Management System 1.0. It is caused by improper sanitization or validation of the 'Name' parameter in a function within the /employees.php file, enabling an attacker to inject SQL commands remotely. This can lead to unauthorized database queries or data manipulation. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, no user interaction required, and limited scope and impact on confidentiality, integrity, and availability. No patch or official remediation is currently documented.

Successful exploitation allows remote attackers to perform SQL injection attacks against the Construction Management System database via the 'Name' parameter in /employees.php. This could result in unauthorized access to or modification of database contents, potentially compromising data confidentiality and integrity. The impact is rated medium severity based on CVSS 4.0 scoring. There is no indication of widespread exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing application-level input validation or web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'Name' parameter in /employees.php. Monitor vendor channels for updates and apply patches promptly once released.