CVE-2026-6030

MediumCVSS 6.3

Published: 10/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

18th percentile - higher than 18% of all known CVEs

Summary

A vulnerability was found in itsourcecode Construction Management System 1.0 in an unknown function of /del1.php. Manipulation of the 'toolname' argument causes SQL injection. Remote exploitation is possible, and the exploit has been published and may be used.

Risk Assessment

Remote SQL injection may allow an attacker to read, modify, or delete database data and, in extreme cases, execute commands on the server. The public availability of the exploit increases the risk.

Recommendation

Introduce query parameterization and validation for the 'toolname' argument in /del1.php. Until a fix is available, consider restricting access to the application.

Other vulnerabilities in Construction Management System

CVE-2026-5620Medium
SQL Injection vulnerability in Construction Management System 1.0. An unknown function in the file /borrowed_equip_report.php allows manipulation of the Home argument, leading to SQL injection. The attack can be performed remotely, and the exploit is publicly available.

Original NVD description (English source)

A flaw has been found in itsourcecode Construction Management System 1.0. The impacted element is an unknown function of the file /del1.php. This manipulation of the argument toolname causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS