The vulnerability CVE-2026-7074 affects itsourcecode Construction Management System 1.0. It is caused by improper sanitization of the 'code' parameter in the /execute1.php file, allowing an attacker to perform SQL injection remotely without any privileges or user interaction. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability. No official patch or fix has been released, and the vendor has not provided remediation details.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion depending on the database privileges. The impact is rated medium due to limited impact metrics and no confirmed active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and sanitization on the 'code' parameter in /execute1.php to prevent SQL injection. Restricting database user privileges and monitoring for suspicious database queries may also help mitigate risk.