CVE-2026-6007

CVE-2026-6007 is a SQL injection vulnerability in itsourcecode Construction Management System version 1.0, specifically in the /del.php file where the equipname parameter is inadequately sanitized. This allows attackers to manipulate input and execute arbitrary SQL queries against the underlying database. The vulnerability carries a CVSS score of 6.3 (Medium severity) with a network-based attack vector requiring low complexity and low privileges to exploit. The attack has limited scope and could result in confidentiality, integrity, and availability impacts, though not at a critical level. The FAUCET Risk Score of 44.0/100 indicates moderate concern. Exploitation status shows the vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog and has no active community attention on Hot List tracking. However, the vulnerability carries higher-than-average statistical risk relative to historical CVE data, and exploit code has been made publicly available, presenting a potential future threat despite current low exploitation rates (EPSS score of 0.0003).