Threat Intelligence Database

CVE-2026-7075 is a medium severity SQL injection vulnerability in itsourcecode Construction Management System version 1.0. The issue occurs in the /locations.php file when the address parameter is manipulated, allowing remote attackers to perform SQL injection. The vulnerability has a CVSS 4.0 base score of 6.9. No official patch or remediation guidance is currently available, and no known exploits in the wild have been reported.

CVE-2026-7074 is a medium severity SQL injection vulnerability in itsourcecode Construction Management System version 1.0. The issue exists in the /execute1.php file where manipulation of the 'code' argument can lead to SQL injection. The vulnerability can be exploited remotely without authentication. The exploit has been publicly disclosed, but there are no known exploits in the wild at this time. No official patch or remediation guidance has been provided by the vendor yet.

CVE-2026-7073 is a medium severity SQL injection vulnerability in itsourcecode Construction Management System version 1.0. The flaw exists in the /execute.php file where manipulation of the 'code' argument allows remote attackers to perform SQL injection. The vulnerability is publicly known and an exploit has been published, but no official patch or remediation guidance is currently available from the vendor.

CVE-2026-6191 is a medium severity SQL injection vulnerability in itsourcecode Construction Management System version 1.0. The flaw exists in an unspecified function within the /equipments.php file, where manipulation of the 'Name' argument can lead to SQL injection. This vulnerability can be exploited remotely without user interaction or elevated privileges. Although the exploit has been publicly disclosed, there are no known exploits in the wild at this time. No official patch or remediation guidance has been provided by the vendor yet.

A flaw has been found in itsourcecode Construction Management System 1.0. The impacted element is an unknown function of the file /del1.php. This manipulation of the argument toolname causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.

CVE-2026-6007 is a medium severity SQL injection vulnerability in itsourcecode Construction Management System version 1.0. The flaw exists in an unknown function within the /del.php file, where the equipname parameter can be manipulated to perform SQL injection attacks remotely. Exploit code has been publicly disclosed, but no official patch or remediation guidance is currently available from the vendor.

CVE-2026-5823 is a medium severity SQL injection vulnerability in itsourcecode Construction Management System version 1.0. The issue exists in an unknown functionality of the /borrowed_tool_report.php file, where manipulation of the 'Home' argument allows remote attackers to perform SQL injection. The vulnerability has a CVSS 4.0 base score of 5.3, indicating a moderate risk. No official patch or remediation guidance is currently available, and there is no evidence of exploitation in the wild. The vulnerability could potentially allow unauthorized database queries if exploited.

CVE-2026-5719 is a medium-severity SQL injection vulnerability in itsourcecode Construction Management System version 1.0. The flaw exists in an unknown function within the /borrowedtool.php file, where manipulation of the 'code' argument can lead to SQL injection. The vulnerability can be exploited remotely without user interaction. Although an exploit has been published, there are no known exploits observed in the wild. No official patch or remediation guidance is currently available.

A vulnerability was found in itsourcecode Construction Management System 1.0. This affects an unknown part of the file /borrowed_tool.php of the component Parameter Handler. The manipulation of the argument emp results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.

CVE-2026-5660 is a medium severity SQL injection vulnerability in itsourcecode Construction Management System version 1.0. The flaw exists in an unknown function within the /borrowed_equip.php file, specifically in the Parameter Handler component, where manipulation of the 'emp' argument can lead to SQL injection. The vulnerability can be exploited remotely without user interaction. Although the exploit has been publicly disclosed, there are no known exploits in the wild at this time. No official patch or remediation guidance is currently available from the vendor.