The vulnerability CVE-2026-7073 affects itsourcecode Construction Management System 1.0. It is caused by improper sanitization of the 'code' parameter in the /execute.php file, enabling remote attackers to inject SQL commands. This can lead to unauthorized database queries or modifications. The CVSS 4.0 base score is 6.9, reflecting medium severity with network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. No official fix or patch is currently documented.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This may result in unauthorized data access or modification, potentially compromising the confidentiality and integrity of the system's data. The impact is rated medium based on the CVSS score and vector metrics. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying temporary mitigations such as input validation or web application firewalls to block malicious SQL injection attempts targeting the 'code' parameter in /execute.php. Monitor vendor channels for updates and apply patches promptly once available.