CVE-2026-5660: fallo de gravedad media en itsourcecode Construction Management System
itsourcecode Construction Management System Parameter borrowed_equip.php sql injection
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
33Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 5.3epss 0.2%
A vulnerability was determined in itsourcecode Construction Management System 1.0. The impacted element is an unknown function of the file /borrowed_equip.php of the component Parameter Handler. This manipulation of the argument emp causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Productos afectados
itsourcecode · Construction Management SystemPoCs públicas encontradas — 1
cve_referencegithub.com/Learner636/CVE-smbmit/issues/4no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — itsourcecode Construction Management System
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-6030MEDIUMitsourcecode Construction Management System del1.php sql injectionEPSS 0.3%CVE-2026-7075MEDIUMitsourcecode Construction Management System locations.php sql injectionEPSS 0.3%CVE-2026-7074MEDIUMitsourcecode Construction Management System execute1.php sql injectionEPSS 0.3%CVE-2026-7073MEDIUMitsourcecode Construction Management System execute.php sql injectionEPSS 0.3%CVE-2026-5719MEDIUMitsourcecode Construction Management System borrowedtool.php sql injectionEPSS 0.3%CVE-2026-5620MEDIUMitsourcecode Construction Management System Parameter borrowed_equip_report.php sql injectionEPSS 0.2%