Threat database

CVE-2026-7074 is a medium severity SQL injection vulnerability in itsourcecode Construction Management System version 1.0. The issue exists in the /execute1.php file where manipulation of the 'code' argument can lead to SQL injection. The vulnerability can be exploited remotely without authentication. The exploit has been publicly disclosed, but there are no known exploits in the wild at this time. No official patch or remediation guidance has been provided by the vendor yet.

CVE-2026-7073 is a medium severity SQL injection vulnerability in itsourcecode Construction Management System version 1.0. The flaw exists in the /execute.php file where manipulation of the 'code' argument allows remote attackers to perform SQL injection. The vulnerability is publicly known and an exploit has been published, but no official patch or remediation guidance is currently available from the vendor.

CVE-2026-6191 is a medium severity SQL injection vulnerability in itsourcecode Construction Management System version 1.0. The flaw exists in an unspecified function within the /equipments.php file, where manipulation of the 'Name' argument can lead to SQL injection. This vulnerability can be exploited remotely without user interaction or elevated privileges. Although the exploit has been publicly disclosed, there are no known exploits in the wild at this time. No official patch or remediation guidance has been provided by the vendor yet.

A vulnerability was found in itsourcecode Construction Management System 1.0. The impacted element is an unknown function of the file /employees.php. Performing a manipulation of the argument Name results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.

A flaw has been found in itsourcecode Construction Management System 1.0. The impacted element is an unknown function of the file /del1.php. This manipulation of the argument toolname causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.

CVE-2026-6007 is a medium severity SQL injection vulnerability in itsourcecode Construction Management System version 1.0. The flaw exists in an unknown function within the /del.php file, where the equipname parameter can be manipulated to perform SQL injection attacks remotely. Exploit code has been publicly disclosed, but no official patch or remediation guidance is currently available from the vendor.

CVE-2026-5823 is a medium severity SQL injection vulnerability in itsourcecode Construction Management System version 1.0. The issue exists in an unknown functionality of the /borrowed_tool_report.php file, where manipulation of the 'Home' argument allows remote attackers to perform SQL injection. The vulnerability has a CVSS 4.0 base score of 5.3, indicating a moderate risk. No official patch or remediation guidance is currently available, and there is no evidence of exploitation in the wild. The vulnerability could potentially allow unauthorized database queries if exploited.

CVE-2026-5719 is a medium-severity SQL injection vulnerability in itsourcecode Construction Management System version 1.0. The flaw exists in an unknown function within the /borrowedtool.php file, where manipulation of the 'code' argument can lead to SQL injection. The vulnerability can be exploited remotely without user interaction. Although an exploit has been published, there are no known exploits observed in the wild. No official patch or remediation guidance is currently available.

CVE-2026-5681 is a medium severity SQL injection vulnerability in itsourcecode sanitize or validate this input version 1.0. The flaw exists in an unknown function within the /borrowedequip.php file's Parameter Handler component, where manipulation of the emp_id argument can lead to SQL injection. The vulnerability can be exploited remotely without user interaction and requires low privileges. Although an exploit has been published, there are no known exploits observed in the wild. No official patch or remediation guidance is currently available.

A vulnerability was found in itsourcecode Construction Management System 1.0. This affects an unknown part of the file /borrowed_tool.php of the component Parameter Handler. The manipulation of the argument emp results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.

CVE-2026-5660 is a medium severity SQL injection vulnerability in itsourcecode Construction Management System version 1.0. The flaw exists in an unknown function within the /borrowed_equip.php file, specifically in the Parameter Handler component, where manipulation of the 'emp' argument can lead to SQL injection. The vulnerability can be exploited remotely without user interaction. Although the exploit has been publicly disclosed, there are no known exploits in the wild at this time. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-5620 is a medium severity SQL injection vulnerability in itsourcecode Construction Management System version 1.0. The issue exists in an unknown function within the /borrowed_equip_report.php file, specifically in the Parameter Handler component. The vulnerability arises from manipulation of the 'Home' argument, allowing remote attackers to perform SQL injection. The exploit has been publicly disclosed, but no official patch or remediation guidance is currently available.

A vulnerability was identified in itsourcecode Online Cellphone System 1.0. Affected by this vulnerability is an unknown functionality of the file /cp/available.php of the component Parameter Handler. Such manipulation of the argument Name leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.

A security flaw has been discovered in itsourcecode Free Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /hotel/admin/login.php of the component Parameter Handler. The manipulation of the argument email results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

A vulnerability was identified in itsourcecode Online Enrollment System 1.0. This affects an unknown function of the file /sms/user/index.php?view=edit&id=10 of the component Parameter Handler. Such manipulation of the argument USERID leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.

CVE-2026-5334 is a medium severity SQL injection vulnerability in itsourcecode Online Enrollment System version 1.0. The issue exists in the parameter handling of the /enrollment/index.php? view=edit&id=3 endpoint, specifically through manipulation of the 'deptid' argument. This vulnerability allows remote attackers to inject SQL commands. Although an exploit is publicly available, there are no known exploits observed in the wild. No patch or official remediation information is currently provided.

CVE-2026-5319 is a cross-site scripting (XSS) vulnerability in the itsourcecode Payroll Management System version 1.0. The issue exists in an unknown function within the /navbar.php file, where manipulation of the 'page' argument can lead to XSS. This vulnerability can be exploited remotely and requires user interaction. The vulnerability has a medium severity rating with a CVSS score of 5.3. No official patch or remediation information is currently available.

A weakness has been identified in itsourcecode Payroll Management System 1.0. Affected by this issue is some unknown functionality of the file /view_employee.php of the component Parameter Handler. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

A security flaw has been discovered in itsourcecode Payroll Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /manage_user.php of the component Parameter Handler. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

A flaw has been found in itsourcecode Free Hotel Reservation System 1.0. Impacted is an unknown function of the file /admin/mod_room/index.php?view=edit. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.