CVE-2026-5719

CVE-2026-5719 is a SQL injection vulnerability identified in itsourcecode Construction Management System version 1.0, specifically within the /borrowedtool.php file's code parameter. The flaw allows authenticated attackers to manipulate input arguments and execute arbitrary SQL commands against the underlying database. This vulnerability affects the confidentiality, integrity, and availability of the application and its data. The vulnerability carries a CVSS v3.1 score of 6.3 (Medium severity) with a network-based attack vector requiring low complexity and valid user credentials, but no user interaction. The attack is remotely exploitable by authenticated users and could result in unauthorized data access, modification, or denial of service. The FAUCET Risk Score of 44.0 out of 100 indicates moderate concern within the vulnerability landscape. While exploit code has been publicly disclosed, the vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog and shows minimal real-world exploitation activity based on its low EPSS score of 0.0001. Community attention appears limited, suggesting the vulnerability primarily affects organizations running this specific construction management system. Organizations using this software should prioritize patching or implementing input validation controls to prevent exploitation.