The vulnerability CVE-2026-6191 affects itsourcecode Construction Management System 1.0. It is a SQL injection issue caused by improper sanitization of the 'Name' parameter in the /equipments.php file. An attacker can remotely manipulate this parameter to inject SQL commands, potentially compromising the database. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability has been publicly disclosed but lacks an official fix or mitigation from the vendor.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary SQL commands on the backend database, which could lead to unauthorized data access or modification. The impact is limited by the low scope and low privileges required, but it still poses a risk to data confidentiality and integrity within the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation or web application firewall (WAF) rules to detect and block malicious SQL injection attempts targeting the 'Name' parameter in /equipments.php. Monitor vendor channels for updates or patches.