The vulnerability CVE-2026-7075 affects itsourcecode Construction Management System 1.0. It arises from improper handling of the 'address' argument in the /locations.php file, allowing an attacker to perform SQL injection remotely without any privileges or user interaction. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low complexity, and no privileges required. The vulnerability could allow an attacker to manipulate backend database queries, potentially leading to unauthorized data access or modification. No official fix or patch is currently available, and the vendor has not provided remediation details.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database via the 'address' parameter in /locations.php. This may lead to unauthorized data disclosure, data modification, or other impacts depending on the database and application context. The CVSS score of 6.9 reflects a medium severity impact with limited scope and low complexity. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'address' parameter in /locations.php. Additionally, review and harden input validation and parameter handling in the affected application component if possible.