CVE-2026-5675

CVE-2026-5675 is a SQL injection vulnerability in itsourcecode Construction Management System version 1.0, specifically within the parameter handler of the /borrowed_tool.php file. The flaw exists in the emp argument, which fails to properly sanitize user input before processing database queries. The vulnerability carries a CVSS 3.1 score of 6.3 (Medium severity) and can be exploited remotely by authenticated users with low attack complexity. A successful exploitation could result in partial compromise of data confidentiality and integrity, as well as limited availability impact. The FAUCET Risk Score of 35.0/100 indicates moderate concern within the threat landscape. While exploit code has been publicly disclosed, the vulnerability currently shows no evidence of active exploitation in the wild, with an exceptionally low EPSS score of 0.000310000. The vulnerability is not included on CISA's Known Exploited Vulnerabilities list and remains inactive on the Hot List, suggesting limited community attention at present. Organizations running this software should apply patches when available and consider implementing input validation controls as a compensating measure.