CVE-2026-7073

HIGH

itsourcecode Construction Management System execute.php sql injection

Title source: cna
STIX 2.1

Description

A flaw has been found in itsourcecode Construction Management System 1.0. This affects an unknown part of the file /execute.php. This manipulation of the argument code causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.

References (5)

Scores

CVSS v3 7.3
EPSS 0.0003
EPSS Percentile 8.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-74 CWE-89
Status published
Products (1)
itsourcecode/Construction Management System 1.0
Published Apr 27, 2026
Tracked Since Apr 27, 2026